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FOREWORD 

This  final  technical  report,  B0M/A-81-016-TR  is  submitted  to  the  Air 
Force  Test  and  Evaluation  Center  by  The  BOM  Corporation,  1801  Randolph 
Rdi  SE,  Albuquerque,  NM  87106,  in  accordance  with  the  requirements  of 
Paragraph  6.6.2  of  Subtask  Statement  1.11/3,  Contract  F29601-79-C-0051. 
The  Air  Force  Technical  Project  Officer  for  this  task  was  Mr.  Neal  F. 
Chamblee,  AFTEC/LG4.  Principal  contributors  to  this  report  were  Richard 
D.  Trapp,  and  William  D.  Farmer.  Other  contributors  were  Robert  R. 
Graber  and  Dr.  Ronald  A.  Luhks.  Dr.  Luhks  was  also  the  BDM  Program 
Director. 

This  study  effort  relied  upon  "Dormant  Reliability  Effects  Analysis 
and  Recommended  Methodology",  B0M/TAC-80-629-TR,  and  the  research  efforts 
of  William  B.  Lindquist,  Mary  Jane  Pence,  Raymond  J.  Walkowski,  Jerry  C. 
Eatherly  and  Dr.  Ronald  A.  Luhks  documented  in  that  technical  report  as  a 
baseline  and  point  of  departure. 
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SECTION  I 
INTRODUCTION 


1.1  PURPOSE. 

This  study  was  conducted  to  investigate  the  effects  of  dormancy  on 
missile  systems/subsystems,  identify  current  dormant  reliability  predic¬ 
tion  methodologies,  and  provide  an  approach  for  assessing  dormant  reli¬ 
ability  and  the  effects  of  dormancy  on  missile,  systems.  This  report 
documents  the  results  of  the  study  effort  and  recommends  an  approach 
which  is  applicable  throughout  the  life  cycle  of  the  missile  system. 

1.2  SCOPE. 

This  report  is  intended, to  summarize  the  current  state-of-the-art  in 
identifying  the  effects  of  dormancy  as  it  relates  to  operational  reli- 
ablity.  It  is  not  intended  to  provide  an  exhaustive  treatment  of  dormant 
reliability.  Documentation  provided  by  AFTEC  and  additional  material  and 
information  acquired  by  The  BOM  Corporation  during  the  study  were  used  to 
formulate  an  approach  for  dealing  with  missile  system  dormancy  as  part  of 
the  OT&E  process.  It  is  clear  that  additional  data  probably  exist;  it  is 
not  as  apparent  that  additional  research  could  provide  greater  insight 
than  that  necessary  to  accomplish  this  task.  The  approach  presented  in 
this  report  will  provide  a  framework  in  which  to  develop  the  detailed 
test  methodology  necessary  to  evaluate  the  effects  of  dormancy  on  a 
specific  missile  system. 

K3  BACKGROUND. 

The  reliability  of  military  systems  after  long  periods  of  dormancy 
has  been  a  major  concern  throughout  military  history.  A  system  taken  out 
of  storage  is  expected  to  accomplish  its  mission  without  a  performance 
degrading  malfunction.  In  early  military  history,  spoilage  of  items  such 
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as  food  and  gunpowar  was  a  major  concern.  A  few  years  ago.  when  aircraft 
availability  exceeded  flying  requirements,  care  was  taken  to  periodically 
move  parked  aircraft  to  mitigate  the  effects  of  nonuse  (e.g. ,  flat  tires, 
fluid  drain,  etc.).  As  military  systems  have  continued  to  become  more 
sophisticated,  complex,  and  expensive,  and  as  their  expected  response 
time  has  become  shorter,  the  need  for  higher  reliability  has  increased. 
Inherent  in  that  need  is  a  requirement  for  higher  dormant  reliability. 

AFTEC  is  currently  involved  in  the  OT&E  of  missile  systems,  and 
there  is  concern  about  the  effects  of  dormancy  because  these  systems 
spend  a  majority  of  their  time  in  a  non-operating  environment.  Some 
types  of  munitions  (e.g.,  bombs,  rockets,  ammunition,  etc.)  typically 
spend  extensive  periods  of  time  in  storage  and  generally  exhibit 
relatively  high  reliability.  On  newer  missile  systems,  however,  complex¬ 
ity  is  increasing,  longer  service  lives  are  required,  and  periodic 
maintenance  and  checkouts  are  being  reduced  or  eliminated.  The  Air  Force 
is  exploring  the  potential  utility  of  the  "wooden  round"  maintenance 
concept.  Therefore,  concern  about  the  effects  of  dormancy  on  a  missile 
system's  operational  reliability  is  growing,  and  development  of  an 
approach  for  assessing  dormant  reliability  as  part  of  the  test  and  evalu¬ 
ation  process  is  becoming  increasingly  important. 

1.4  STUDY  APPROACH. 

The  approach  taken  in  this  study  effort  is  graphically  portrayed  in 
figure  1.  The  principal  segments  involved  ah  extensive  literature 
search;  interviews  with  various  interested  Individuals;  identification  of 
current  techniques,  methodologies,  and  experience;  assessment  of  the 
applicability  and  useability  of  current  procedures  within  the  framework 
of  OT&E;  devising  modifications  to  existing  techniques  or  suggesting  new 
ones  where  the  current  techniques  are  lacking  or  Inadequate;  and  formula¬ 
tion  and  documentation  of  a  structured  approach  for  assessing  the  effects 
of  dormancy  on  missile  systems. 
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Figure  1.  Study  Approach  Methodology 
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1.5  REPORT  STRUCTURE. 

This  report  has  been  structured  to  provide  discussion  of  relevant 
topics  in  a  logical  progression  which  builds  to  the  proposed  approach. 
Section  II  presents  a  compilation  of  pertinent  concerns  about  dormancy 
and  establishes  the  need  for  considering  its  effects.  The  nature  of  the 
dormancy  problem  is  characterized  in  section  III  with  considerable  effort 
devoted  to  the  definitions  of  key  words,  terms,  and  expressions.  Part  of 
the  dormancy  problem  is  the  current  lack  of  a  consistent  lexicon.  Sec¬ 
tion  IV  summarizes  documented  experience  and  techniques  for  estimating 
dormant  reliability.  Significant  facets  of  the  weapon  system  acquisition 
process,  the  specific  missile  system  being  developed,  and  the  overall 
test  and  evaluation  process  which  warrant  special  consideration  in  a 
dormant  reliability  evaluation  are  summarized  in  section  V.  In  particu¬ 
lar,  the  notion  of  the  missile  system’s  life  cycle  profile— the  central 
theme  of  the  recommended  approach— and  the  essential  need  to  formulate 
it  early  in  the  planning  phase  is  introduced.  The  heart  of  the  study 
effort  is  embodied  in  section  VI.  Specific  analytical  techniques  and 
innovative  test  methods  are  described  in  terms,  of  the  applicability 
within  various  phases  of  the  missile  system  acquisition  and  development 
process.  Several  data  systems  exist  within  the  Services,  but  their 
useability  is  limited  because  of  inherent  inconsistencies  in  their  struc¬ 
ture  and  content— those  limitations  are  discussed  in  section  VII. 
Section  VIII  presents  the  bottom  line— a  structured  approach  for  asses¬ 
sing  dormant  reliability  within  the  context  of  a  comprehensive  test  and 
evaluation  program.  Primary  conclusions  and  recommended  subject  areas 
for  further  study  are  provided  in  section  IX. 

Several  topic  areas  addressed  in  this  report  warrant  more  detailed 
discussion  than  is  considered  appropriate  for  the  body  of  the  report. 
Therefore,  annexes  to  the  report  have  been  provided  to  address  specific 
topics  In  greater  detail.  Annex  A  provides  a  discussion  of  MIL-HDBK-217B 
failure  rate  calculation  procedures.  Annex  B  describes  some  of  the  more 
prevalent  causes  of  missile  system  dormant  reliability  degradation.  The 
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missile  system's  life  cycle  profile  is  the  central  theme  in  the  approach 
to  assessing  dormant  reliability,  and  an  example  of  the  life  cycle  model¬ 
ing  methodology  is  presented  in  annex  C  to  demonstrate  its  utility. 
Annex  D  provides  a  discussion  of  the  fundamental  tool  in  life  testing-- 
tht  exponential  distribution--and  some  methods  for  determining  sample 
size  requirements.  Various  electronic  equipment  screening  methods  em¬ 
ployed  during  the  infant  mortality  period  are  compared  in  annex  E. 
Various  reports,  papers,  text  books,  and  other  sources  of  information 
have  been  itemized  in  annex  F. 
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SECTION  II 

THE  NEED  FOR  CONSIDERING  DORMANCY  EFFECTS 

2.1  TRENDS  IN  MISSILE  SYSTEMS. 

Missile  systems  which  are  or  will  be  entering  the  Air  Force  weapons 
inventory  during  the  1980s  can  generally  be  described  as  more  complex. 
The  new  generation  missiles  employ  more  sophisticated  technologies  in 
guidance  and  control,  propulsion,  and  other  major  subsystems.  Increased 
complexity  and  sophistication  and  their  attendant  higher  development  and 
production  costs  contribute  substantially  to  longer  service  life  require¬ 
ments  and  perhaps  smaller  production  quantities.  Additionally,  newer 
missile  systems  are  being  developed,  as  much  as  possible,  to  be  deployed 
as  "wooden  rounds."  Under  this  concept,  missiles  are  accepted  and 
deployed  to  operational  units  as  "all  up  rounds"  with  minimal  field-level 
checkout  and  maintenance. 

2.2  DORMANCY  AND  MISSILE  SYSTEMS. 

Dormancy  and  its  effect  on  weapon  system  reliability  has  been  a 
concern  throughout  military  history.  Systems  removed  from  storage  are 
expected  to  perform  without  mission  degrading  malfunctions.  The  sophis¬ 
tication  and  complexity  of  modern  weapons  coupled  with  the  rapid  response 
time  required  to  effectively  counter  the  expected  threat  preclude  exten¬ 
sive  checkout  and  repair  .prior  to  employment.  Dormancy  in  missile  sys¬ 
tems  is  a  particular  concern  because  these  systems  spend  the  majority  of 
their  life  in  a  non-operating  (e.g. ,  storage,  alert,  captive  carry,  etc.) 
environment.  The  wooden  round  maintenance  concept  for  missile  systems 
clearly  increases  the  ratio  of  non-operating  time  to  operating  time.  In 
a  typical  missile  system,  even  with  periodic  checkout,  non-operating  time 
could  be  as  much  as  two  million  times  longer  than  operating  time.  Even 
though  the  operating  failure  rate  may  be  substantially  greater  than  the 
non-operating  failure  rate,  the  significant  difference  in  time  between 


THE  BDM  CORPORATION 


these  two  states  makes  dormancy  a  major  factor  to  consider  when  attempt¬ 
ing  to  estimate  or  project  a  mature  missile  system's  operational 
reliability. 

2.3  WEAPON  SYSTEM  DEVELOPMENT  PROCESS. 

Weapon  system  development  is  intended  to  provide  capabilities  to 
satisfy  operational  mission  needs  identified  by  using  commands.  At  the 
first  in  a  series  of  key  decision  points,  Milestone  0,  exploration  of 
alternative  solutions  begins.  During  this  phase  of  the  program,  the 
using  command  begins  developing  preliminary  system  operational  concepts 
for  the  various  alternatives.  This  general  concept  describes  the  intended 
purpose,  employment,  deployment,  and  maintenance  concept  for  the  weapon 
system.  The  relative  importance  or  impact  of  dormancy  on  a  missile 
system's  reliability  can  be  initially  evaluated  during  this  conceptual 
phase  of  the  development  process.  As  the  development  program  progresses 
’nto  its  demonstration  and  validation  phase,  alternative  solutions  are 
refined  and  selected,  operational  and  maintenance  concepts  are  updated 
and  finalized,  and  DT&E  and  IOT&E  may  be  conducted.  During  full-scale 
engineering  development,  the  missile  system  will  be  designed,  fabricated, 
tested,  and  evaluated.  IOT&E  must  be  accomplished  with  the  most  realistic 
test  events  possible  to  provide  data  which  will  enable  decision  makers  to 
determine  whether  or  not  the  missile  system  meets  stated  requirements. 
Based  upon  test  results  using  preproduction  missile  systems,  AFTEC  will 
have  to  provide  a  projection  of  the  mature  missile  system's  operational 
reliability.  The  effects  of  dormancy  will  have  to  be  accounted  for  in 
that  projection,  and  estimates  will  be  further  refined  during  the  produc¬ 
tion  and  deployment  phase  of  the  missile  system's  life  cycle. 

2.4  TEST  AND  EVALUATION. 

Test  and  evaluation  may  occur  at  any  point  in  the  missile  system's 
life  cycle  to  identify,  assess,  and  reduce  acquisition  risks;  to  evaluate 
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operational  effectiveness  and  operational  suitability;  and  to  identify 
deficiencies  in  the  system.  During  the  conceptual  phase,  T&E  may  be 
accomplished  to  help  select  preferred  alternative  concepts.  AFTEC  in¬ 
volvement  could  include  providing  test  results  on  similar  missile  systems. 
In  the  demonstration  and  validation  phase,  T&E  is  conducted  to  minimize 
design  risks  and  demonstrate  feasibility.  The  majority  of  T&E  conducted 
during  this  phase  will  be  accomplished  by  the  contractor  as  components 
and  subsystems  are  evaluated  to  make  trade-offs  that  will  satisfy  design 
and  operational  requirements.  As  prototype  or  preproduction  systems 
become  available,  some  articles  can  be  set  aside  to  begin  assessing  the 
effects  of  dormancy  on  the  missile  system's  reliability.  IOT&E  will  be 
accomplished  during  the  full-scale  engineering  development  phase  to 
estimate  the  operational  effectiveness  and  operational  suitability  of  the 
mature  missile  system.  Those  estimates  will  be  refined  as  a  result  of 
FOT&E  conducted  during  the  production  and  deployment  phase. 

Obviously,  the  quality  of  initial  reliability  projections  developed 
by  AFTEC  analysts  will  depend  upon  several  factors  including  the  avail¬ 
ability  of  test  articles  and  the  length  of  the  test  and  evaluation  pro¬ 
gram.  It  is  eoually  apparent  that  measuring  the  effects  of  dormancy  on 
missile  system  reliability  can  require  a  long  time  relative  to  the  time 
available  for  i&E  prior  to  a  production  decision.  Various  techniques  are 
available  to  the  operational  tester  to  permit  development  of  a  credible 
estimate  of  missile  system  dormant  reliability  early  in  its  life  cycle. 
Fundamental  to  their  successful  application  is  early  involvement  by  the 
operational  tester  in  the  missile  system  acquisition  and  development 
process. 

2.5  POLICY,  GUIDANCE,  ANO  DIRECTION. 

This  research  effort  has  identified  extremely  limited  guidance  on 
the  requirements  for  and  the  design  and  conduct  of  testing  for  dormant 
reliability.  Reliability  testing  is  addressed  in  a  general  sense  under 
the  cover  of  operational  suitability  In  0MB  Circular  A- 1 09,  the  DOD 
5000-series  directives,  AFR  80-14,  apd  AFTECR  23-1.  MIL- STD- 1388-1 , 
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Logistics  Support  Analysis,  mentions  dormant  reliability  by  stating  that 
the  Logistics  Support  Analysis  for  reliability  factors  provides  data  for 

"...effects  of  storage,  shelf  life,  _ "  The  data  input  to  the  LSA 

comes  from  MIL-STD-785  reliability  programs.  This  MIL-STD,  Reliability 
Program  for  Systems  and  Equipment  Development  and  Production,  discusses 
administrative  requirements  and  general  guidance  for  reliability  testing 
but  provides  no  specific  guidance  for  dormant  reliability  assessment. 

Studies  completed  by  RAOC  related  to  non-operating  failures  have 
consistently  concluded  that  government  documents  establishing  and  sup¬ 
porting  reliability  requirements  should  be  upgraded  to  include  provisions 
for  nonoperating  mode  reliability  requirements  and  predictions.  Degrada¬ 
tion  effects  in  various  dormancy  states  (e.g. ,  operationally  ready  stor¬ 
age,  transportation  and  handling,  launcher  carriage,  alert,  captive 
carry)  must  be  considered  in  addition  to  only  those  of  the  normally 
energized  (active)  state. 

2. 6  IS  THERE  A  NEED? 

The  preceding  discussions  of  the  inherent  nature  of  missile  systems 
and  the  evolving  maintenance  concepts  associated  with  them  have  indicated 
that  dormancy  is  a  major  portion  of  a  missile  system's  life  cycle. 
Furthermore,  the  operational  tester  must  provide  an  estimate  of  the 
projected  mature  missile  system's  operational  reliability  during  the 
full-scale  engineering  development  phase  of  the  acquisition  process.  It 
follows  that  there  is  a  need  to  assess  the  impact  of  dormancy  on  missile 
system  reliability,  and  that  need  exists  early  in  the  acquisition  process. 
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SECTION  III 

CHARACTERIZATION  OF  THE  DORMANCY  PROBLEM 
3. 1  GENERAL  NATURE  OF  THE  PROBLEM. 

As  discussed  in  the  previous  section,  there  is  a  need  to  assess 
dormant  reliability  and  its  impact  on  missile  systems.  The  task  or 
problem  at  hand  i$  to  develop  methods  that  AFTEC  may  us^  to  measure, 
predict,  and  assess  dormant  reliability  and  the  effects  of  dormancy  in 
the  operational  environment.  One  major  aspect  of  the  problem  is  the  lack 
of  consistent  or  well-defined  methods  in  current  practice  which  meet 
AFTEC 's  needs. 

In  reviewing  the  body  of  knowledge  on  the  subject,  one  of  the  most 
noticeable  facts  is  that  the  definitions  employed  by  the  various  studies, 
reports,  government  documents,  and  reliability  programs  varied  widely. 
This  is  more  than  just  a  definitional  consistency  problem.  It  is 
directly  indicative  of  the  differences  in  goals,  purposes,  and  appli¬ 
cations  reflected  by  the  literature.  Data  structures,  sources,  and  the 
accounting  which  supports  the  data  also  vary  widely  and  represent  signif¬ 
icant  obstacles  to  comparison  of  results  from  different  programs  or 
studies,  applying  them  to  OT&E,  and  to  the  development  of  methodologies 
which  could  approach  "universal"  application. 

With  this  brief  Introduction  of  the  general  nature  of  the  problem  in 
mind,  the  approach  employed  by  this  study  effort  is  to  modify/tailor 
existing  approaches  or  develop  new  ones  to  meet  AFTEC's  needs  while  still 
tracking  with  the  development  process  and  the  players  involved.  This  is 
critical  if  AFTEC  Is  to  pursue  early  Involvement  In  the  weapons  system 
development  process  and  still  produce  meaningful  results  during  test  and 
evaluation  from  an  operational  environment  perspective.  The  structure  of 
definitions  is  such  that  ambiguity  of  data  and  data  application  may  be 
reduced  as  much  as  possible  and  that  results  from  early  development 
processes  may  be  related  to  later  ones. 
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Note  that  tailoring  and  developing  new  methodologies  carries  some 
risk  in  that  the  resulting  approach  may  be  untried  or  unproven.  The 
development  of  the  necessary  methods  is,  in  fact,  still  in  its  infancy. 
In  this  regard,  some  of  the  methods  which  are  suggested  later  in  this 
report  should  be  viewed  as  having  potential  application  and  should  be 
verified  before  being  accepted  as  standard  practice. 

In  the  most  general  sense,  the  challenges  presented  by  the  dormancy 
problem  are  not  really  new  but  represent  a  specific  example  of  a  tradi¬ 
tional  AFTEC  requirement— to  assess  and  predict  operational  effectiveness 
and  suitability  early  in  the  development  process  and  before  systems  are 
fully  fielded.  The  inherent  perspectives  of  the  players  are  also  the 
same.  The  development  contractor  is  concerned,  with  inherent  reliability 
while  the  user  is  concerned  with  field  reliability.  Inconsistent  data 
reporting  and  time  accounting  has  also  been  a  persistent  problem.  The 
effects  of  given  levels  of  reliability  in  the  operational  environment  are 
generally  not  fully  demonstrated  until  after  OT&E.  Thus  there  has  always 
been  a  need  for  AFTEC  to  make  projections  to  maturity.  The  same  is  true 
for  dormant  reliability  of  missile  systems  except  that  the  time  period 
between  estimates  and  full  field  verification  may  be  longer.  Thus,  in  the 
general  sense,  the  dormant  reliability  problem  can  be  viewed  as  being  a 
subset  of  the  overall  assessment  and  projection  to  maturity  mission  of 
AFTEC. 

3.2  DEFINITIONS. 

The  definitions  which  follow  are  provided  so  that  the  specific 
problem  of  addressing  dormant  reliability  and  dormancy  effects  may  be 
placed  in  the  proper  context.  They  also  will  provide  a  basis  for  inter¬ 
preting  the  differences  in  the  needs  presented  by  OT&E  requirements  and 
other  needs— such  as  those  of  the  weapon  system  developer  or  contractor. 
Definitions  which  are  in  common  usage  by  AFTEC  are  not  presented  herein 
unless  there  is  a  direct  relationship  to  the  dormancy  problem,  per  se. 
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The  definition  of  dormant  is  presented  last  because  it  is  built  by 
using  the  other  definitions  in  context.  Alternate  definitions  of  dormant 
which  are  in  current  usage  are  also  provided  so  that  the  reader  may  see 
the  logic  involved  in  structuring  a  definition  of  dormant  which  can  be 
utilized  for  OT&E  purposes  but  which  may  also  accomodate  data  from  other 
phases  of  weapon  system  development. 

3.2.1  All  Up  Round  (AUR). 

An  all  up  round  is  a  missile  which,  in  its  operational  configura¬ 
tion,  can  be  used  in  its  intended  combat  role  without  installation  of  any 
parts,  components,  or  subsystems.  This  definition  applies  to  the  missile 
itself  and  not  to  any  launch  equipment,  pylons,  or  launch  platforms.  One 
possible  exception  is  that  the  concept  of  operations  for  some  missiles 
might  require  fins  to  be  installed  before  usage.  Such  cases  should  be 
addressed  on  an  exception  basis. 

3.2.2  Wooden  Round. 

A  wooden  round  is  defined  as  an  AUR  with  "minimal1'  field  mainte¬ 
nance.  "Minimal"  in  this  case  is  defined  as  a  pre-selected  list  of  on- 
equipment  maintenance  actions,  depending  on  the  maintenance  concept. 
Wooden  rounds  are  generally  "checked"  in  the  field  and  returned  to  a 
depot  or  other  central  location  for  all  corrective  maintenance.  Incor¬ 
porating  a  pre  selected  list  of  on-equipment  maintenance  actions  into  the 
definition  allows  a  single  definition  to  be  employed  with  tailoring  for 
specific  missile  systems.  By  using  specific  action  taken  codes  to 
describe  "minimal"  field  maintenance,  data  may  be  collected  which  cap¬ 
tures  the  appropriate  events.  AFR  80-5/AFSC  SUP  1,  Figure  A2-1,  12  April 
1979,  contains  a  good  summary  of  on-  and  off-equipment  maintenance 
actions. 
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3.2.3  On-Equipment  Maintenance. 

APR  80-5,  Attachment  1,  defines  on-equipment  maintenance  as  : 
Maintenance  actions  accomplished  on  a  complete  end  arti¬ 
cle  (aircraft,  drones,  trainers,  registered  support 
equipment,  photographic  equipment,  ground  CEM  equipment, 
special  weapons,  complete  round  munitions,  uninstalled 
aircraft  engines  and  L  systems).  This  includes  support 
general  work  (scheduled  and  special  inspections,  and  so 
forth),  removal  and  replacement  of  components,  and  fix- 
in-place  repair  actions. 

For  the  purposes  of  this  report  a  complete  end  article  is  considered  to 
be  an  AUR  with  the  possible  exception  that  some  missile  engines  (gas 
turbines,  for  Instance)  may  be  considered  to  be  end  articles.  The  reason 
for  addressing  on-equipment  maintenance  is  that  it  is  critical  to  the 
definition  of  dormant.  There  is  some  confusion  as  to  the  status  of  a 
missile  during  maintenance.  In  addition  (as  will  be  seen  later)  it  is 
necessary  to  address  dormancy  at  below  the  system  level.  Thus  major 
subsystems  are  considered  to  be  in  a  dormant  status  during  on-equipment 
maintenance  and  not  in  a  dormant  status  during  off-equipment  maintenance. 
The  reasons  for  this  convention  are  twofold.  First,  confusion  is  elimi¬ 
nated  by  considering  a  major  subsystem  to  be  restored  to  original  specifi¬ 
cations  during  off-equipment  maintenance  and  thus  considering  the  "dor¬ 
mancy  clock"  to  be  started  over  at  the  subsystem  level.  Secondly,  ambi¬ 
guity  In  data  collection  can  be  eliminated.  This  convention  may  be  some¬ 
what  arbitrary  but  It  does  represent  a  reasonable  compromise.  In  addi¬ 
tion,  wooden  rounds  can  now  be  distinctly  considered  as  a  subset  of  all 
other  missiles  In  terms  of  dormant  reliability  and  the  methodologies/ 
data  which  will  be  used  to  address  them. 

3.2.4  Off-Equipment  Maintenance. 

AFR  80-5,  Attachment  1,  defines  off  equipment  maintenance  as: 
"In-shop  maintenance  actions  performed  on  removed  components,  except 
complete  aircraft  engines." 
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For  the  purpose  of  this  report,  "removed  components"  include  all  sub¬ 
systems  (2  digit  WUC)  and  below.  The  discussion  of  paragraph  3.2.3 
applies. 

3.2.5  Life  Cycle. 

The  life  cycle  of  a  missile  system  is  defined  as  the  period  of  time 
from  conceptual  design  through  disposal  of  the  system.  It  includes 
development,  acquisition,  operations,  maintenance,  support  and  all 
actions  associated  with  taking  the  missile  out  of  the  inventory. 

3.2.6  Life  Cycle  Profile. 

A  life  cycle  profile  is  a  diagram  or  other  representation  of  the 
states  or  status  of  a  missile  during  its  life  cycle  or  any  major  segment 
of  its  life  cycle. 

3.2.7  Service  Life. 

AFR  136-1  defines  service  life  as:  "The  length  of  time  an  item  can 
remain  Installed  In  operating  configuration  or  In  actual  usage."  This 
definition  would  appear  to  apply  to  all  items  (explosive,  electronic, 
etc.).  The  definition  does  not  appear  to  mean  the  same  thing  as  mean 
life,  or  mean  time  between  malfunction,  but  implies  the  actual  end  of 
useful  operation  due  to  wearout.  For  the  purposes  of  this  report,  ser¬ 
vice  life  Is  considered  to  be  the  length  of  time  from  which  a  missile  Is 
originally  sent  to  the  field  until  it  Is  no  longer  In  operational  use. 

3.2.8  Shelf  Life. 

AFR  136-1  defines  shelf  life  as: 

The  length  of  time  an  Item  may  remain  in  storage 
under  prescribed  packaging  and  storage  conditions. 

The  expiration  date  for  shelf  life  on  Items  with  the 
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month  and  year  listed  is  the  last  day  of  the  month. 

Shelf  life  begins  on  the  item's  manufacture,  cure, 
or  assembly  date. 

This  definition  actually  applies  to  items  that  cannot  be  brought  back  to 
the  original  specifications  once  they  reach  a  certain  age;  e.g. ,  film 
that  degrades,  powder  that  chemically  decomposes,  etc.  It  does  not  seem 
to  apply  to  an  electronic  assembly  tnat  has  a  malfunction  that  can  be 
repaired  to  retain  its  original  specifications. 

3.2.9  Operating. 

Operating  is  defined  as  the  state  of  a  subsystem,  assembly,  or 
a  ponent  when  it  is  activated  (as  designed)  by  electrical  or  mechanical 
means  at  any  level  of  stress.  Operating  is  synonymous  with  "switch  on." 
However,  some  care  must  be  exercised  when  considering  operating  time  for 
dormant  reliability  purposes.  For  Instance,  a  rocket  motor  is  operating 
when  it  is  ignited.  However,  an  electronic  subsystem  such  as  a  guidance 
unit  may  be  operating  at  various  levels  of  stress  when  it  is  tested  in  a 
check-out  procedure,  during  BIT,  in  captive  carry,  or  in  actual  firing. 
At  the  subsystem  level,  if  any  portion  of  the  subsystem  is  operating, 
then  the  entire  subsystem  is  considered  to  be  operating. 

3.2.10  Non-Operating. 

A  subsystem,  assembly,  or  component  Is  considered  to  be  non-oper- 
atlng  when  it  1$  experiencing  none  of  the  electrical  or  mechanical 
stresses  Inherent  in  the  (designed)  activation  of  that  subsystem, 
assembly,  or  component.  It  may  however  be  experiencing  stress  caused  by 
the  environment,  transporatlon  and  handling,  captive  carry  G  forces,  etc. 
Non-operating  tlae  is  a  subset  of  dormancy  and  can  be  considered  to  be 
the  time  between  subsystem  activations. 
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3.2.11  Storage. 

Storage  is  uefined  as  the.  state  in  which  a  system,  subsystem, 
assembly,  or  component  is  zero  percent  activated  and  is  in  its’  normal 
configuration  in  a  storage  area.  (Note  that  storage  is  a  subset  of 
non-operating. ) 

3.2.12  Inherent  Dormant  Reliability. 

,  Inherent  dormant  reliability  is  that  state  wherein  an  AUR  is  main¬ 
tained  in  a  storage  area  and  is  totally  non-operating.  It  does  not 
include  any  maintenance  or  functional  checks/BIT. 

3.2.13  Operationally  Ready  Storage. 

Operationally  ready  storage  is  that  state  in  which  an  all  up  round 
is  maintained  in  a  storage  area  awaiting  operational  use.  The  AUR  sub¬ 
systems  may  be  operating  to  the  extent  necessary  to  maintain  the  "ready" 
st^.us  for  immediate  use.  The  events  of  "operating"  in  a  storage  area 
should  be  rare,  but  depending  upon  design,  it  is  necessary  to  include 
this  possible  state  for  an  all-inclusive  definition.  For  instance,  a 
battery  or  gyro  may  be  energized  or  activated  in  operationally  ready 
storage. 

It  is  important  to  note  that  operationally  ready  storage  as  defined 
herein  is  essentially  the  primary  mode  of  "dormant"  in  the  generic  sense 
and  is  a  central  issue  of  dormancy.  Because  the  common  usage  of  the  term 
dormant  is  so  broad,  It  is  necessary  to  define  this  new  term.  Inherent 
dormant  reliability  for  an  AUR  could  be  considered  to  be  non-operating 
operationally  ready  storage  reliability.  Dormancy  effects,  however,  must 
consider  a  broader  definition.  If  a  specification  were  to  state  that  a 
missile  system  must  withstand  a  given  period  of  dormancy  and  still  be 
highly  reliable,  that  statement  might  really  be  referring  to  a  subset  of 
the  dormancy  issue,  namely,  operationally  ready  storage.  The  other 
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aspects  that  must  be  considered  require  that  the  tern  dormant  be  defined 
in  the  broader  sense  which  follows. 


Dormancy  is  defined  (for  the  purposes  of  this  report)  as  those 
states  wherein  an  all  up  round  is  not  operating  or  is  maintained  in 
operationally  ready  storage  including  all  on-equipment  maintenance  and 
functional  checks/BIT  necessary  to  maintain  the  desired  status.  Dormancy 
includes  the  non-operating  portions  of  alert,  captive  carry,  transporta¬ 
tion  and  handling,  and  launcher  carriage.  Non  operating  refers  to  sub¬ 
systems  which  are  installed  in  an  AUR.  A  Venn  diagram  of  this  definition 
is  provided  in  figure  Z.  Note  that  dormancy  is  defined  at  the  subsystem 
level,  but  requires  that  those  subsystems  be  installed  in  an  all  Lp 
round.  This  concept  is  logical  in  that  some  subsystems  may  be  totally 
inactive  (rocket  motors,  for  instance)  while  other  subsystems  (such  as 
guidance  units)  may  be  operating  during  various  phases  of  the  missile's 
life  cycle  prior  to  actual  firing.  In  addition,  some  missile  systems 
(air-to-air  in  particular)  may  rotate  through  various  operational  pos¬ 
tures— operationally  ready  (O.R.)  storage  to  alert,  back  to  O.R.  storage, 
captive  carry,  and  back  to  O.R.  storage,  etc.  Strategic  systems  may 
spend  long  periods  of  time  in  an  alert  status  with  guidance  systems 
operating  and  the  remainder  of  the  subs>stems  totally  inactive. 

The  operationally  ready  storage  mode  Is  predominant  in  that  this 
state  is  where  "long  periods"  of  dormancy  accrue.  The  ability  of  a 
system  to  withstand  these  "long  periods"  may  be  influenced  ‘■y  relatively 
short  periods  of  operating  time  or  the  stress  Inherent  in  other  states 
such  as  transportation,  captive  carry,  or  launcher  carriage.  Conversely, 
the  ultimate  operational  reliability  s  influenced  by  the  system's  abil¬ 
ity  to  withstand  "long  periods"  of  dormancy.  Thus,  a  synergistic  rela¬ 
tionship  exists  when  all  possible  states  and  the  interactions  among  them 

.  '  ( 

must  be  considered. 
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SUBSYSTEM  LIFE  CYCLE 


Figure  2.  Dormancy:  Subsystem  Level,  Based  on.  Subsystem  Installed 
in  AUR,  Nonoperating  Time,  on-Equipment  Maintenance,  and 
Functional  Checks/Bit  in  Storage  (Includes  Operationally 
Ready  Storage  as  a  Subset) 
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3.2.15  Alternate  Definitions  of  Dormancy. 

The  following  definitions  are  in  current  usage  and  are  provided  for 
purposes  of  contrast. 

3.2.15.1  Alternate  Definition  1. 

Dormancy  is  the  state  in  which  a  system,  subsystem,  or  component  is 
between  zero  and  10  percent  electrically  energized  and  is  in  its  normal 
configuration  for  operation  but  in  a  storage  area.  A  Venn  diagram  of 
this  definition  is  provided  in  figure  3.  Close  examination  of  this 
figure  in  light  of  the  previous  discussion  will  highlight  some  obvious 
deficiencies.  Components  and  piece  parts  in  storage  are  included. 
Although  the  literature  (see  references  18  and  29)  shows  no  statistical 
difference  between  the  failure  rates  for  systems  that  are  dormant  or 
parts  (from  those  systems)  that  are  in  storage.  It  is  virtually  impos¬ 
sible  to  track  components  or  parts  from  storage  all  the  way  through 
installation  iii  an  AUR  in  terms  of  elapsed  time.  The  arbitrary  10  per¬ 
cent  electrically  energized  limit  also  presents  some  problems.  As  dis¬ 
cussed  earlier,  some  subsystems  may  be  fully  operating  while  others  are 
fully  non-operating  within  the  same  missile  at  a  given  point  in  time. 
Finally,  there  is  no  provision  for  handling  the  synergistic  nature,  of 
dormancy. 

3.2.15.2  Alternate  Definition  2. 

Another  definition  in  current  practice  is  as  follows: 

Dormancy  is  the  state  whe-ein  a  device,  a  component, 
or  a  part  is  connected  to  a  system  in  the  normal 
operational  configuration  and  experiences  below  normal 
or  periodic  structural,  mechanical,  electrical,  or 
environmental  stresses  for  prolonged  periods  up  to 
five  years  or  more  before  being  used  in  a  mission. 
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As  before,  a  Venn  diagram  of  this  definition  is  provided  in  figure  4. 
This  definition  is  realistic  except  it  is  obviously  very  difficult  to 
determine  how  much  "stress"  is  appropriate.  The  difficulties  of  con¬ 
sistent  tracking  through  a  data  system  are  obvious. 

3.3  DORMANT  RELIABILITY. 

Reliability  can  be  considered  to  be  the  probability  that  an  item 
will  remain  failure  free  over  a  specified  period  of  time  (or  be  in  a 
failure  free  state  after  a  specified  period  of  time).  In  considering 
dormant  reliability,  the  same  definition  of  reliability  applies  except 
that  "over  time"  covers  several  possible  states  which  exhibit  potentially 
different  failure  characteristics.  Thus  a  full  treatment  of  dormant 
reliability  must  consider  all  possible  states— inherent  dormant  reli¬ 
ability,  operationally  ready  storage  reliability,  non-operating  trans¬ 
portation  and  handling  launcher  carriage  reliability,  and  non-operating 
captive  carry  reliability. 

3.4  DORMANCY  EFFECTS. 

The  effects  of  dormancy  in  missile  systems  must  be  considered  at 
several  levels  and  in  a  hierarchical  sense.  The  usual  failure  modes  and 
effects  analysis  (FMEA),  which  is  accomplished  early  in  the  missile 
system's  life  cycle,,  Is  at  the  very  lowest  level  in  the  hierarchy.  A 
discussion  of  dormancy  effects  and  the  causes  of  system  reliability 
degradation  at  the  more  traditional  FMEA  level  is  provided  in  annex  B. 
Second  in  the  heirarchy  is  the  fact  that  dormancy  effects  a  given  level 
of  reliability,  dormant  reliability  effects,  in  the  context  used  in  this 
discussion,  must  reflect  the  Implication  or  ultimate  Impact  upon  oper¬ 
ational  reliability.  From  an  AFTEC  perspective,  It  is  necessary  to  recog¬ 
nize  the  difference  between  logistics  and  operations  effects. 

The  effects  of  dormant  reliability  on  logistics  are  more  closely 
representative  of  traditional  FMEA  but  only  in  a  limited  sense.  The 
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logistics  system  will  be  concerned  with  all  types  of  failures  (i.e.  ,  Type 
1,  2,  and  6)  because  the  impacts  are  not  significantly  different. 
Required  spares  provisioning,  manpower  requirements,  and  their  associated 
costs  throughout  tne  missile  system's  life  cycle  are  affected  by  dormant 
reliability  and  must  be  correctly  estimated  if  the  missile  system  is  to 
be  adequately  supported.  The  effects  of  dormant  reliability  on  operations 
are  more  closely  related  to  the  capability  of  the  missile  system  to 
function  effectively.  Basically,  not  all  "failures"  are  critical.  Those 
which  are  certainly  affect  operations;  those  which  are  not  may  impact 
operations,  but  they  directly  affect  logistics. 

The  task  for  the  operational  test  analyst  is  to  determine  those 
failures  which  directly  affect  operational  capability.  For  example, 
suppose  a  certain  seal  tends  to  dry  out  and  crack  after  prolonged  periods 
of  dormancy.  An  FHEA  would  conclude  that  hydraulic  fluid  leaks  because 
the  seal  cracks.  The  logistics  analyst  would  conclude  that  more  spare 
missiles  will  be  required  to  support  the  wooden  round  maintenance  concept 
because  the  hydraulic  actuation  system  leaks  during  storage.  The  opera¬ 
tions  analyst  will  conclude  that  the  missile  will  probably  miss  the 
target  because  the  hydraulics  system  fails  to  drive  the  control  surfaces. 
The  effects  of  dormancy  must  be  addressed  at  a  level  which  permits  esti¬ 
mation  of  their  impact  upon  operational  effectiveness. 

3.5  INHERENT  LIMITATIONS. 

Several  limitations  inherent  In  the  nature  of  the  dormancy  problem 
are  worthy  of  mention.  First,  it  is  extremely  difficult  to  know  when  a 
failure  has  occurred.  Unless  there  are  fairly  frequent  checks  performed, 
a  failure  may  not  be  detected  until  a  missile  is  put  to  an  operational 
"test"  or  actual  live  firing.  If,  for  Instance,  several  years  have 
elapsed  during  a  dormant  period  and  the  missile  then  fails  to  operate  as 
intended,  when  did  the  failure  occur?  Second,  It  is  well  known  that 
checking  a  missile  may  cause  a  failure.  In  fact  some  manufacturers  limit 
the  number  of  functional  checks  or  BITs  in  their  warranty.  Third,  it  is 
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generally  difficult  to  tell  what  caused  failures—age,  transportation 
stresses,  manufacturing  defects,  induced  maintenance  failures,  etc. 
Measuring  dormant  reliability  then  poses  a  different  sort  o*  problem  than 
the  typical  operating  system  in  test  and  evaluation.  In  addition  to 
these  aspects,  data  systems  are  not  structured  to  capture  the  elements 
necessary  for  testing  or  validation  nor  do  they  accurately  account  for 
time  or  age— factors  central  to  the  dormancy  issue. 

3.6  LIMITATIONS  ASSOCIATED  WITH  CURRENT  APPROACHES. 

The  current  "state  of  the  art"  is  not  directly  applicable  to  the 
OT&E  environment.  Most  of  the  existing  methodologies  are  oriented  toward 
the  development  contractor's  or  SPO's  needs  and  are  concerned  with  devel¬ 
oping,  predicting,  and  validating  accomplishment  of  specification  require¬ 
ments.  In  addition,  they  are  geared  to  inherent  reliability  as  opposed 
to  field  reliability  and  are  almost  always  accomplished  at  the  piece 
parts  level.  When  adjustment  factors  (or  K  factors)  are  developed  to 
account  for  the  lack  of  operational  reality,  they  are  often  "backfitted" 
to  meet  the  specification  or  get  the  right  answer.  In  addition,  K  fac¬ 
tors,  as  will  be  seen  later,  are  highly  system  dependent  and  generally 
are  applied  at  the  piece  part  level.  Even  the  better  known  and  docu¬ 
mented  surveillance  programs  (IHAWK  as  discussed  later)  have  failed  to 
isolate  the  causes  of  reliability  degradation  among  aging,  transporta¬ 
tion,  test  equipment  and  procedures ,  and  environment.  In  addition, 
traditional  surveillance  programs  are  oriented  toward  engineering  "fixes" 
(by  lot).  There  is  nothing  wrong  with  this  goal,  except  that  it  does  not 
directly  assist  In  OT&E  or  projections  to  maturity. 

3.7  ITERATIVE  AND  LONG  TERM  NATURE  OF  THE  PROCESS. 

With  the  previous  discussions  in  this  section  as  a  background,  it  is 
obvious  that  there  are  no  ready  made  solutions  to  the  dormancy  problem. 
Actual  measurement  of  dormant  reliability  is  a  long  term  process  —  10 
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years  or  so--and  one  which  will  require  many  test  assets.  These, 
unfortunately,  are  luxuries  that  AFTEC  can  generally  not  afford. 

The  logical  conclusion  then,  is  to  pursue  the  development  of  early 
estimating  projection  methodologies  (even  rules  of  thumb)  and  test  meth¬ 
odologies  that  can  be  improved  over  time.  In  addition,  AFTEC  involvement 
and  coordination  with  all  of  the  system  development  players  is  essential 
so  that  early  program  data,  tests,  and  surveillance  programs  can  be 
structured  in  a  mutually  supportive  way.  Finally,  detailed  knowledge  of 
other  methodologies,  even  though  they  might  not  be  applicable  to  OT&E, 
and  knowledge  of  missile  systems  at  large  are  both  necessary  if  "experi¬ 
ence"  is  to  be  iteratively  applied  toward  improving  the  process. 
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SECTION  IV 

EXPERIENCE  AND  THE  "STATE  OF  THE  ART" 

4.1  CURRENT  METHODOLOGIES. 

Current  techniques  for  estimating  dormant  reliability  generally  fall 
into  three  rather  broad  categories  of  analytical  prediction  based  upon 
parts  count  and  stress,  failure  rate  modification  factors,  and  testing. 
Each  of  these  broad  technique  categories  has  advantages  and  disadvantages 
which  would  warrant  the  cautious  use  of  their  results  in  a  dormant  reli¬ 
ability  assessment  program.  Current  dormant  reliability  prediction 
techniques  are  typically  applied  during  the  design  and  early  development 
phases  of  the  missile  system’s  life  cycle  and  may  not  be  directly  appli¬ 
cable  in  an  IOT&E  program.  However,  the  operational  tester  will  have 
access  to  data  generated  by  the  developer,  and  an  understanding  of  the 
general  nature  of  the  data  will  be  necessary  if  it  is  to  be  used  in  the 
operational  reliability  projection. 

4.1.1  Parts  Count  and  Stress  Analysis  Prediction. 

MIL-H0BK-217C,  Reliability  Prediction  of  Electronic  Equipment, 
provides  two  methods  of  reliability  prediction  for  electronic  parts. 
Both  methods  are  applicable  during  the  design  phase  of  the  system 
although  they  require  different  degrees  of  information  to  apply  them. 
They  provide  a  basis  for  reliability  predictions  during  acquisition 
programs  for  military  electronic  systems  and  equipment.  Both  methods  are 
summarized  here;  more  detailed  discussions  are  provided  In  annex  A. 

The  parts  count  reliability  prediction  method  assumes  that  the 
equipment  failure  rate  Is  a  function  of  the  failure  rates  of  its  com¬ 
ponents  or  parts.  The  Information  needed  to  apply  the  method  Is  generic 
part  type  and  the  number  of  such  parts  in  the  equipment,  the  quality 
level  of  the  part,  and  the  equipment  environment.  This  prediction  method 
Is  applicable  during  the  early  design  phase  and  is  generally  used  during 
bid  proposal  since  it  permits  relatively  easy  comparison  and  evaluation 
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of  alternative  proposed  concepts.  It  should  be'  noted,  however,  that 
failure  rates  derived  using  this  method  may  apply  only  if  the  entire 
equipment,  i.e. ,  all  of  the  generic  parts,  is  to  be  used  in  one  and  the 
same  environment.  If  not,  then  the  method  should  be  applied  separately 
to  portions  of  the  equipment  in  each  environment.  The  total  equipment 
failure  rate  can  then  be  estimated  by  adding  these  “environment-equipment" 
failure  rates  which  have  been  scaled  using  appropriate  environmental 
factors.  The  current  MIL-HDBK-217C  provides  factors  for  11  different 
environmental  states.  A  recent  update  has  expanded  the  list  to  23  envir¬ 
onmental  states. 

The  part  stress  analysis  prediction  method  requires  a  greater  amount 
of  detailed  information  and  is  applicable  during  the  later  design  phase 
where  actual  hardware  and  circuits  are  being  designed.  Part  quality, 
environmental  stress,  thermal  aspects,  circuit  and  package  complexities, 
densities,  and  connections  are  factors  which  are  accounted  for  in  this 
method.  MIL-H0BK-217C  provides  reliability  prediction  models  for  various 
categories  of  electronic  components  to  be  used  for  estimating  both  oper¬ 
ating  and  non-operating  failure  rates.  It  is  not  likely  that  the  opera¬ 
tional  tester  will  employ  this  prediction  method  to  estimate  dormant 
reliability,  but  the  missile  system  being  developed  will  probably  base 
early  reliability  predictions  on  this  technique. 

4.1.2  Failure  Rate  Modification  Factors. 

Numbers  which  are  used  to  modify  failure  rates  to  account  for  vary¬ 
ing  stresses  imposed  by  different  applications  and  environments  are 
generally  known  as  K  factors.  They  are  used  and  misused  to  adjust  a 
basic  rate  experience  for  hardware  when  directly  applicable  experience 
data  are  not  available.  Factors  have  been  developed  and  applied  at  all 
levels  from  generic  parts  to  total  systems.  Success  in  these  efforts  has 
also  varied  as  is  evidenced  by  the  following  examples. 

Derr,  Van  Hooroe,  and  Girdis  (reference  33)  used  failure  rate  data 
from  several  different  military  system  programs  to  develop  a  method  of 
predicting  MOS/LSI  failure  rates  in  automotive  applications.  Unfor¬ 
tunately,  although  the  prediction  model  was  based  upon  derivations  from 
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empirical  data  sources,  verification  of  the  model  was  not  possible  due  to 
insufficient  history  of  LSI  devices  in  the  automobile. 

Boeing  (references  84  and  85)  provided  a  technique  for  developing 
K  factors  at  equipment  and  LRU  levels  using  field  experience  data. 
Equipment  classes  included  mechanical/nydraulic,  electromechanical, 
electronic,  and  battery.  Applications  considered  were  ground,  ship, 
satellite,  and  aircraft.  This  method,  by  using  actual  field  experience 
data,  developed  factors  to  "fit  the  data"  at  the  individual  LRU  level. 
By  combining  LRU-level  factors  for  each  of  the  primary  equipment  classes, 
an  average  K  factor  was  obtained  for  each  cl  ass- application.  These 
factors  were  then  "validated"  against  empirical  field  data  and  revealed 
that  a  ball  park  estimate  could  be  obtained  within  each  equipment  class. 

General  Dynamics  (references  82  and  83)  developed  K  factors  based  on 
estimated  environmental  severity  for  use  in  the  Ground  Launched  Cruise 
Missile  Squadron  Operations  and  Maintenance  Simulation  Model.  Factors 
were  obtained  for  the  missile,  transporter-erector- launcher,  and  launch 
control  center  for  15  different  environments.  The  K  factors  were  used  to 
normalize  all  environments  to  the  comparative  base  of  dormant  storage. 
The  validity  of  the  K  factors  used  in  this  effort  must  await  failure  rate 
data  from  field  experience  with  the  GLCM  weapon  system.  It  is  inter¬ 
esting  to  note,  however,  that  reliability  predictions  obtained  with  this 
approach  equal  or  exceed  stated  requirements. 

As  a  final  example,  Shelley  and  Stovall  (reference  32)  provided 
insight  into  the  problem  of  predicting  field  reliability  performance  from 
MIL-STD-781  laboratory  test  results  and,  conversely,  the  problem  of 
translating  required  operational  levels  of  field  reliability  into  com¬ 
parable  quantitative  levels  to  be  demonstrated  in  the  laboratory.  Fif¬ 
teen  specific  factors  and  a  general  one  (i.e. ,  all  other  differences) 
were  identified  that  contribute  to  differences  between  laboratory  and 
field  achieved  results.  The  study  examined  data  for  35  major  C-5A  equip¬ 
ment  items,  but  the  results  could  not  conclusively  show  that  the  transla¬ 
tion  between  laboratory  and  field  data  could  be  improved  by  the  use  of  K 
factors. 
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What,  if  any,  conclusion(s)  can  be  drawn  from  documented  experience 
involving  development  and  application  of  K  factors?  K  factors  are  only  a 
tool.  Failure  rates  derived  from  applying  K  factors  should  be  less 
accurate  than  rates  derived  from  directly  comparable  experience.  K 
factors  probably  have  more  applicability  at  the  part  or  component  level 
and  will  continue  to  be  used  by  system  developers  as  the  basis  for  build¬ 
ing  higher  level  (i.e. ,  equipment,  subsystem,  etc.)  K  factors.  At  best, 
K  factors  may  provide  ballpark  relationships  between  application  environ¬ 
ments. 

4.1.3  Testing. 

Testing  provides  the  mechanism  for  obtaining  empirical  failure  rate 
data.  There  are  two  driving  considerations  in  any  test  program:  sample 
size  and  required  time.  The  sample  size  which  must  be  used  to  establish 
a  high  reliability  at  a  reasonable  confidence  level  is  generally  prohib¬ 
itive  in  a  real  world  situation.  From  an  operational  viewpoint,  the 
necessary  sample  may  be  unattainable  early  in  a  weapon  system's  life 
cycle  since  there  are  limited  quantities  of  pre-production  systems  avail¬ 
able,  and  they  may  not  be  representative  of  mature  production  systems. 
The  time  available  for  accomplishing  a  comprehensive  test  program  is 
finite  and  limited  and  may  not  be  compatible  with  the  estimated  time 
required  to  accomplish  all  necessary  testing.  Testing  can  be  accomp¬ 
lished  in  real  time  or  in  an  accelerated  manner. 

4. 1.3.1  Accelerated  Testing. 

Accelerated  or  overstress  testing  is  a  common  method  used  to  obtain 
failure  rate  data  in  a  relatively  short  time  period.  It  requires  a  know¬ 
ledge  of  the  predominant  failure  mode  under  rated  stress  conditions,  the 
environment  which  excites  the  failure  mode,  and  a.  quantitative  rela¬ 
tionship  between  the  level  of  the  stress  environment  and  the  rate  of 
occurrence  of  the  failure.  Once  this  relationship  Is  obtained.  It  can  be 
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used  to  determine  an  estimate  of  the  failure  rate  within  the  application 
environment  of  interest.  Accelerated  testing  can  be  an  effective  method 
of  obtaining  part,  component,  or  subsystem  level  failure  rate  data. 

Part  screening  is  a  form  of  accelerated  testing  applied  during  the 
infant  mortality  phase  of  the  equipment's  life.  A  more  detailed 
discussion  of  screening  methods  is  provided  in  annex  E.  Its  purpose  is 
to  compress  the  early  failure  period  and  reduce  the  failure  rate  to 
acceptable  levels  as  quickly  as  possible.  It  is  assumed  that  inferior 
devices  will  fail  and  superior  devices  will  pass  provided  the  tests  and 
stress  levels  are  properly  selected.  The  operational  tester,  when  using 
data  obtained  from  screening,  should  recognize  that  it  may  exhibit  an 
abnormal  failure  rate  which  must  be  accounted  for  in  any  reliability 
prediction. 

Microcircuit  devices  exhibit  a  catastroDhic  failure  rate  which 
decreases  linearly  with  the  recripocal  of  the  absolute  junction  tempera¬ 
ture.  It  has  been  shown  (reference  29)  that  use  of  the  Arrhenius  model 
is  acceptable  for  applications  in  aging  processes  in  which  temperature  is 
the  only  accelerating  factor.’  The  Eyring  model  is  somewhat  more  advanced 
and  accounts  for  two  accelerating  factors:1  junction  temperature  and 
applied  bias  voltage.  Neither  of  these  techniques  have  been  proven  to  be 
exact  models  of  the  time-stress  combination  with  respect  to  failure 
rates.  However,  they  are  reasonable  approximations  when  applied  within 
the  bounds  of  specified  conditions. 

Solid  rocket  motors  are  subjected  to  accelerated  environmental 
testing  at  the  Naval  Ordnance  Station,  Indian  Head,  MO.  The  facility 
provides  environmental  (e.g. ,  temperature)  changes  at  twice  the  expected 
seasonal  rate.  Results  of  the  2  to  1  testing  have  correlated  closely 
with  similar  failure  rate  data  obtained  from  field  experience.  The 
correlation  has  been  qualitative  to  date;  no  rigorous  mathematical  com¬ 
parison  has  been  accomplished. 

Power  on/off  cycling  has  been  shown  to  have  a  definite  adverse 
effect  upon  electronic  equipment  reliability.  Accelerated  power  on/off 
cycling  has  an  overwhelming  tendency  to  Induce  failures  In  the  open  mode 
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and  appears  to  be  particularly  effective  in  precipitating  poor  conduc¬ 
tivity  fault  points  (reference  18).  The  incidence  of  power  on/off  cycling 
failure  rates  was  correlated  with  dormant  failure  rates  for  various 
components  and  indicated  that  a  single  power  on/off  cycle  can  be  as  much 
as  1,000  times  more  stressful  or  effective  in  causing  failures  than  1 
hour  of  dormant  time.  However,  the  results  were  highly  component- 
dependent. 

Accelerated  testing  has  been  a  very  effective  method  of  reducing  the 
time  required  to  accomplish  the  magnitude  of  testing  necessary  to  provide 
a  statistically  significant  measure  of  reliability  on  low  failure  rate 
items.  The  literature  research  has  revealed  that  accelerated  testing  has 
generally  been  restricted  to  components.  Several  problems,  are  encoun¬ 
tered  when  accelerated  testing  principles  are  applied  to  a  complete 
system  or  even  to  reasonably  complex  subsystems  or  subassemblies.  The 
foremost  problem  is  determination  of  the  acceleration  factor.  Accelera¬ 
tion  factors  have  been  validated  at  the  part  level  by  testing  at  various 
stress  levels.  However,  at  the  system  level,  it  is  highly  unlikely  that 
validation  of  applicable  acceleration  factors  could  be  achieved.  A 
second  related  problem  has  to  do  with  failure  mechanisms.  If  individual 
parts  are  sensitive  to  different  stresses,  it  would  not  be  reasonable  to 
expect  that  a  single  stress  could  be  chosen  to  provide  an  accelerated 
test.  This  research  effort  has  failed  to  identify  any  documented  evi¬ 
dence  of  successful  system  level  accelerated  testing. 

4. 1.3.2  Real-Time  or  Surveillance  Testing. 

Testing  which  is  not  accelerated  is  typically  accomplished  in  real 
time  and,  with  respect  to  reliability  testing,  is  generally  referred  to 
as  surveillance  testing.  It  is  a  detailed  test,  analysis,  and  reporting 
program  to  compare  a  missile  system  to  established  standards  for  pro¬ 
jecting  shelf  and  service  life  throughout  Its  life  cycle.  In  the  broad¬ 
est  sense.  It  Includes  screening  and  other  forms  of  accelerated  testing 
discussed  earlier,  acceptance  testing,  and  both  developmental  and  opera¬ 
tional  testing.  However,  in  the  more  traditional  sense  a  surveillance 
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test  places  a  specified  number  of  preproduction  or  production  missiles  in 
actual  or  simulated  field  storage  conditions.  Periodically,  selected 
samples  of  these  assets  are  removed  from  storage  and  examined  for  degra¬ 
dation  from  original  specifications.  The  examination  may  include  BIT, 
disassembly  and  inspection,  or  live  firing.  Typically,  surveillance 
programs  are  designed  to  provide  engineering  fixes  for  the  missile  system 
and  not  necessarily  to  provide  the  operational  tester  with  a  ready  method 
for  predicting  mature  system  operational  reliability.  The  surveillance 
program's  value  to  the  operational  tester  lies  in  the  availability  of 
similar  system  data  upon  which  to  base  a  comparability  analysis  when 
developing  an  early  system  reliability  prediction.  Several  surveillance 
test  programs  exist  and  provide  potentially  usable  information.  A  sam¬ 
pling  of  those  programs  is  included  in  the  next  section. 

4.2  EXAMPLES  OF  SPECIFIC  EXPERIENCE. 

4.2.1  TOW,  MGM-71. 

The  tow  is  an  anti -armor  missile  used  by  infantry  personnel.  It  is 
tube- launched,  optically  guided,  and  controlled  by  wire.  The  Army  began 
a  10-year  test  program  in  1976  to  determine  the  storability  of  the  mis¬ 
sile.  Each  year  60  missiles  are  checked,  and  failures/malfunctions  are 
analyzed.  The  missiles  to  be  tested  are  obtained  from  the  Canal  Zone, 
Alaska,  Arizona,  and  Alabama.  Thirty- two  parameters  of  missile  electronic 
units  (MEU)  are  recorded  and  plotted.  Sixteen  of  the  60  MEUs  tested  each 
year  are  retained  for  future  testing.  Hence,  the  number  of  MEUs  available 
for  testing  increases  each  year,  and  there  will  be  160  MEUs  in  test/ 
storage  at  the  end  of  the  10-year  test  period.  After  3  years  of  observa¬ 
tion  and  testing,  no  parameter  drift  trends  have  been  detected,  but  it 
has  been  determined  that  handling  ?nd  manufacturing  errors  have  accounted 
for  most  of  the  50  failures  which  occurred  in  the  180  missiles  tested. 
None  of  the  failures  were  consided  mission  critical,  i.e. ,  they  would  not 
have  resulted  in  an  in-flight  failure  or  degraded  missile  performance. 
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4.2.2  MAVERICK,  AGM-65. 

The  MAVERICK  is  an  air-to-ground,  electro-optical  guided  missile  for 
tactical  fighter  aircraft.  Ogdert  Air  Logistics  Center  has  complete 
engineering  responsibility  for  the  missile.  The  ALC  has  an  ongoing  test 
program  and  provides  quarterly  reports  of  missile  failures  detected 
during  testing.  To  date,  25,000  missiles  have  been  manufactured  and 
stored;  4,161  have  been  tested.  At  the  present  time,  the  hydraulic  actu¬ 
ator  system  (HAS)  of  the  missile  has  a  higher  failure  t ate  (leaks  which 
would  not  necessarily  abort  the  missile)  than  the  guidance  and  electronic 
units.  It  has  been  found,  however,  that  after  the  HAS  leaks  have  beer, 
repaired,  by  either  shop  or  field  personnel,  the  failure  rate  doubles. 
The  mechanical  part  of  the  HAS  is  subject  to  time  degradation  of  relia¬ 
bility,  but  the  degradation  is  not  significant.  Some  gimbal  bearings 
have  "frozen  up"  because  of  lubricant  runoff.  The  guidance  unit  has 
exhibited  no  age  related  failure  trend.  The  entire  missile  has  exceeded 
its  specified  reliability.  Current  system  storage  reliability  is  90 
percent;  the  specified  was  80  percent.  Present  flight  reliability  is 
also  near  80  percent.  The  inspection  frequency  may  be  reduced  because  of 
this  high  reliability;  inspections  were  at  12  months,  then  24  months.  At 
present,  36  months  is  being  considered. 

4.2.3  COPPERHEAD,  M-712. 

The  COPPERHEAD  missile  is  a  cannon  fired  projectile  which  is  guided 
to  i*  *rget  by  a  laser  designator.  The  Army  is  procuring  these  mis¬ 
sile  ...  large  quantities  to  be  stored  worldwide.  A  surveillance  test 
program  will  be  establised  to  detect  and  fault  analyze  each  malfunction. 
The  program  is  called  Storage  Reliability  Verification  Test  (SRVT)  and  is 
composed  of  four  parts:  Baseline  Analysis,  Accelerated  Aging  Tests, 
Real-Time  Aging  Tests,  and  Real-Time  Field  Aging  Tests.  Baseline  analysis 
will  completely  analyze  two  electronic  and  two  electrical  parts  for 
electrical,  physical,  and  mechanical  properties  to  form  a  baseline.  Data 
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from  various  sources  will  be  gathered  and  analyzed  to  determine  the 
environment  to  which  the  electronic  parts  will  be  subjected  for  accel¬ 
erated  aging  tests.  The  initial  estimate  of  the  average  acceleration 
factor  for  an  environment  of  85°C,  85  percent  relative  humidity,  and 
effectively  0  PSIG,  is  44.  The  plastic  packaged  COPPERHEAD  integrated 
circuits  are  being  subjected  to  this  environment  to  validate  or  modify 
the  estimated  aging  factor  of  44.  Seven  samples  will  be  drawn  from' the 
first  acceptance  lot  of  each  part  type  for  real-time  aging  tests.  Two 
will  be  used  for  baseline  and  five  others  will  be  stored  in  real-time 
storage.  The  storage  will  be  in  a  plastic  bag  at  room  ambient  tempera¬ 
tures  and  conditions.  Every  6  months  the  items  will  be  removed  and 
tested  for  each  baseline  parameter.  Real-time  field  aging  tests  will  be 
conducted  on  all  up  rounds.  A  total  of  16  projectiles  will  be  stored  at 
various  locations  in  the  CONUS.  Each  location  will  provide  a  different 
environment,  but  all  projectiles  will  be  in  open  storage.  Every  6  months 
the  rounds  will  be  returned  to  the  factory  for  functional  tests.  Failures 
will  be  analyzed  and  trend  analyses  will  be  accomplished.  Also,  all  of 
the  386  engineering  development  missiles  will  have  storage  data  collected 
for  analyses. 

4.2.4  ALCM,  AGM-86. 

The  ALCM  is  currently  undergoing  follow-on  test  and  evaluation 
(FOT&E)  at  Edwards  Air  Force  Base,  California.  One  of  the  major  objec¬ 
tives  of  the  test  effort  is  to  measure  and  estimate  the  reliability  of 
the  ALCM.  However,  because  of  limited  resources  and  time,  direct  dormant 
reliability  testing  or  measurement  has  not  been  attempted.  Rather,  a 
procedure  for  projecting  the  dormant,  or  non-operational,  reliability 
from  operational  failure  data  is  being  used.  This  procedure  involves  the 
projection  of  operational  reliability  to  mature  system  operations  and  a 
K  factor  multiplication  to  convert  projected  operational  reliability  to 
projected  dprmant  reliability. 

The  ALCM  test  team  has  parti ti toned  the  total  time  ALCMs  spend  under 
test  into  five  phases:  ground  inactive  (GI),  captive  Inactive  (Cl), 
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ground  active  (6A),  captive  active  (CA),  and  free  flight  (FF).  All  ALCM 
failures,  to  include  Types  1,  2,  and  6,  have  been  recorded  as  have  total 
operating  time  and  total  possessed  time.  An  attempt  has  been  made  to 
partition  the  observed  failures  into  the  phase  each  ALCM  was  in  when  the 
failure  occurred.  However,  uncertainties  arise  when  an  ALCM  is  transi¬ 
tioned  from  a  non-operating  state  to  an  operating  state  during  verifica¬ 
tion  testing  or  flight  operations.  A  failure  that  is  detected  at  these 
points  cannot,  under  certainty,  be  classified  as  having  occurred  during 
the  non-operational  period  or  as  having  occurred  when  power  was  applied. 
To  remain  on  a  conservative  estimate  side;  therefore,  when  calculating  an 
estimated  operational  MTBF  for  the  ALCM,  the  total  number  of  failures 
that  have  occurred  in  all  phases  is  used.  Thus: 

urpr  _  Total  Operational  Time  (CA,  GA,  FF) _ 

H  (operational)  “  Total  Failures  All  Phases  (CA,  GA.  FF,  Ct,  61) 

Total  operational  time  for  the  ALCM  has  been  defined  simply  as 
"power-on"  time  or  active  time.  The  failures  that  are  counted  in  the 
denominator  are  all  Type  1  failures  plus  all  mission  critical  Type  2 
failures. 

The  procedures  used  in  estimating  the  dormant  reliability  of  the 
ALCM  are  as  follows:  (1)  calculate  the  most  current  operational  MTBF 
using  only  Type  1  failures  in  the  denominator,  (2)  project  the  calculated 
reliability  to  mature  system  operations  (2  years  after  IOC)  using  the 
Duane  projection  technique, , and  (3)  use  a  system  level  K  factor  to  convert 
the  operational  reliability  estimate  to  a  dormant  reliability  estimate. 

Because  of  perceived  differences  in  the  characteristics  of  the  ALCM 
engine  and  the  rest  of  the  ALCM,  the  engine  reliability  estimation  is 
handled  separately.  The  same  estimation  procedure  Is  used  for  the  engine; 
however,  the  reliability  growth  rate  and  K  factor  used  are  different  and 
apply  to  the  engine  only. 


36 


THE  BDM  CORPORATION 


4.2.5  I  HAWK,  MIM-23B. 

The  Improved  HAWK  Missile  Stockpile  Reliability  Assessment  Program 
represents  one  of  the  most  comprehensive  surveillance  programs  in  exis¬ 
tence  (reference  81).  It  also  appears  to  be  one  of  the  most  successful 
and  is  being  used  as  a  basis  for  structuring  similar  programs  for  new 
missile  systems.  Because  the  IHAWK  might  well  be  considered  the  state-of- 
the-art  in  surveillance  testing,  its  surveillance  program  is  described  in 
more  detail  than  those  of  the  preceding  sample  programs. 

The  basic  HAWK  Missile  System  developed  and  deployed  in  the  latter 
part  of  the  1950's  contained  an  electron  tube  missile  guidance  section. 
The  maintenance  test  concept  employed  at  that  time  required  the  missile 
to  be  disassembled,  tested,  and  repaired  in  the  field  under  varying  envi¬ 
ronmental  conditions.  The  exposure  of  missile  guidance  section  critical 
components  to  various  environments,  numerous  tests  of  the  missiles  during 
their  useful  life,  extended  run-cycles  during  standby  alerts,  and  workman¬ 
ship  of  field  personnel  during  rejpair  and  application  of  MWOs,  caused  a 
large  number  of  induced  failures.  The  overall  in-flight  reliability  of 
the  basic  HAWK  Missiles  during  ASP  was  less  than  65  percent  even  though 
the  missiles  were  "checked  out"  immediately  prior  to  firing. 

When  the  Improved  HAWK  Missile  design  was  contemplated,  elimination 
of  all  of  the  foregoing,  undesirablej  operational  characteristics  were 
given  a  high  priority  with  the  intent  of  "designing  them  out"  of  the 
system.  Those  design  considerations  resulted  in  a  solid  state  electron¬ 
ics  guidance  section  (package)  with  the  inherent  qualities  of  extended 
component  life  and  greater  component  stability.  Reduced  operating  time, 
elimination  of  field  testing,  and  curtailment  of  any  missile  disassembly 
and  modifications  in  an  uncontrolled  field  environment  wdre  added  as 
operational  constraints.  The  expected  operational  life  of  this  new 
missile  design  was  initially  estimated  as  5  years  based  on  the  individual 
component  aging  characteristics,  stability,  and  reliability.  The  new 
missile  design  and  use-concept  eventually  came  to  be  called  the  Certified 
Round  Missile. 
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Improved  HAWK  Missiles  are  produced  in  discrete  blocks  or  production 
lots.  Acceptance  and  initial  certification  of  a  production  lot  of  mis¬ 
siles  is  not  made  until  completion  of  lot  acceptance  flight  test,  and  is 
based  on  all  of  the  process  production  tests,  including  100  percent 
static  test  of  guidance  packages  as  well  as  the  flight  test  data  of 
sample  missiles.  The  initial  certification  starts  at  the  piece  part 
level  and  continues  through  final  assembly  of  the  missiles.  After  missile 
guidance  packages  are  assembled  to  GFE  components,  a  sample  of  missiles 
from  the  lot  is  randomly  selected  for  lot  acceptance  firing  tests.  A 
minimum  of  three  missiles  and  up,  to  twenty  missiles  may  be  fired  before 
the  production  lot  is  "accepted"  or  "rejected."  The  lot  acceptance 
flight  tests  are  designed  to  require  that  the  missiles  accomplish  inter¬ 
cept  on  a  variety  of  target  parameters.  The  specified  levels  for  relia¬ 
bility  and  lethality  must  be  met. 

Once  the  missile  lot  has  been  accepted,  it  is  deployed  to  opera¬ 
tional  field  units.  As  the  missile  changes  location  or  status,  field 
units  record  the  changes  and  provide  the  information  to  the  data  base. 
No  maintenance  is  performed  by  the  field  units,  the  missiles  are  not 
operated  until  flight,  and  they  are  not  subjected  to  testing  in  the 
field. 

Each  year  a  random  sample  of  each  missile  lot  is  tested  at  Theater 
Readiness  Monitoring  Facilities  (TRMF)  around  the  world  to  .valuate 
degradation  in  missile  readiness  due  to  handling,  aging,  and  environment. 
Each  missile  returned  to  the  TRMF  is  subjected  to  a  series  of  tests 
identical  to  those  performed  at  the  factory.  The  test  results  are  trans¬ 
mitted  from  the  TRMF  to  the  deployment  data  bank  where  all  lot  informa¬ 
tion  is  used  in  a  comprehensive  trend  analysis  to  provide  readiness 
assessment  and  to  indicate  possible  future  trouble  areas. 

The  system  described  above  has  effectively  maintained  the  readiness 
posture  of  the  fielded  IHAWK  Certified  Missile  over  the  past  8  years  to 
the  extent  that  no  firing  battery  has  entered  a  Red  Status  due  to  lack  of 
ready  missiles.  This  favorable  readiness  posture  and  a  missile  with 
higher  in-flight  reliability  has  been  achieved  at  a  substantial  cost 
saving,  when  compared  to  the  Basic  HAWK  experience. 
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4.3  SUMMARY. 

Current  methodologies  for  projecting  missile  system  operational 
reliability  early  in  the  system's  life  cycle  tend  to  focus  at  the  part 
level.  Prediction  techniques  rely  on  parts  count  and  part  stress  anal¬ 
ysis  methods.  The  expanding  use  of  K  factors  to  adjust  or  modify  failure 
rates  to  account  for  varying  stresses  imposed  by  different  applications 
and  environments  also  seem  to  be  more  appropriate  at  the  part  level. 
Applicability  at  the  system  or  even  the  major  subsystem  level  requires 
further  study  and  development.  Accelerated  testing  techniques  are  also 
tailored  to  part  testing.  In  fact,  it  is  doubtful  that  accelerated 
testing  could  be  effectively  applied  at  the  system  level  without  signifi¬ 
cant  additional  study  and  analysis.  Surveillance  testing  can  also  pro¬ 
vide  potentially  useful  data,  but  it  will  generally  come  from  a  similar 
program. 

There  are  many  sources  of  useful  data  for  the  operational  tester  to 
use  when  developing  early  predictions  of  a  new  missile  system's  opera¬ 
tional  reliability.  However,  extreme  caution  must  be  exercised  to  ensure 
that  the  nature  of  the  data  (e.g. ,  source,  derivation,  similarities/ 
dissimilarities,  etc.)  is  thoroughly  understood. 
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SECTION  V 

NECESSARY  CONSIDERATIONS  AND  PREREQUISITES 
5. 1  ACQUISITION  PROCESS  CONSIDERATIONS. 

The  weapon  system  development  process  was  briefly  outlined  in 
section  II.  Figure  5  provides  an  indication  of  relationships  between 
reliability  life  cycle  activities  and  the  various  phases  within  the 
acquisition  process.  Major  milestone  decision  points  are  also  shown. 
The  weapon  system  acquisition  process  and  the  associated  role  of  the  OT&E 
agency  are  described  in  AFM  55-43,  and  there  is  little  which  can  be  added 
to  that  discussion.  It  is  readily  apparent,  as  revealed  in  figure  5, 
that  a  great  deal  of  information  is  available  to  the  operational  tester 
early  in  the  missile  system's  life  cycle. 

The  AFTEC  planning  process  will  usually  begin  at  or  near  Milestone  0 
and  continue  beyond  Milestone  II  to  the  start  of  IOT&E.  Early  in  the 
conceptual  phase,  reliability  specifications  will  be  formulated  by  the 
developing  command  from  the  using  command's  operational  requirements. 
Depending  upon  the  quantity  and  quality  of  information  available  as  input 
to  |the  dormant  reliability  assessment  approach  described  in  section  VIII, 
some  initial  insight  into  dormant  reliability  requirements  could  be 
obtained  during  the  conceptual  phase.  Throughout  this  initial  phase  of 
missile  system  development,  the  system  program  office  (SPO)  and  the 
developing  contractor(s)  will  comprise  the  principal  sources  of  data  to 
be  used  in  the  reliability  prediction  process.  The  data,  however,  will 
generally  be  limited  to  specifications  and  preliminary  designs. 

As  the  program  progresses  into  the  validation  phase,  data  should  be 
available  from  failure  modes  analyses,  design  reviews,  initial  reli¬ 
ability  evaluation  tests,  and  failure  analyses.  Again,  the  SPO  and 
contractor  will  be  the  sources  of  the  information.  From  the  operational 
tester's  viewpoint,  the  useabllity  of  the  data  will  depend  upon  his 
understanding  of  how  it  was  obtained.  Initial  estimates  of  test  and 
support  resources  necessary  to  accomplish  IOT&E  must  also  be  Identified 
during  this  period. 
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During  IOT&E,  operational  failure  rate  data  will  be  available,  and 
some  dormant  failure  rate  data  should  be  available  from  the  surveillance 
program.  That  assumes,  of  course,  that  the  surveillance  test  program  was 
initiated  during  the  planning  phase.  AFTEC  involvement  in  the  missile 
system's  life  cycle  may  well  extend  into  at  least  the  initial  phases  of 
FOT&E.  The  types  of  data  available  to  the  operational  tester  are  not 
unlike  that  which  are  obtained  during  IQT&E.  Again,  however,  the  nature 
or  characteristics  of  the  data  may  be  different  and  must  be  thoroughly 
understood.  Principally,  failure  rate  data  will  be  obtained  from  produc¬ 
tion  missile  systems  which  are  employed  by  the  using  command  under  condi¬ 
tions  more  representative  of  the  expected  operational  environment.  As  in 
IOT&E,  failure  data  will  include  both  inherent  and  induced  failures. 
Dormant  failure  data  from  the  surveillance  program  should  also  be  avail¬ 
able.  Caution  is  advised  early  in  FOT&E  because  of  the  potential  dif¬ 
ferences  in  missile  systems.  While  production  missiles  may  be  providing 
operational  failure  rate  date,  similar  data  obtained  from  the  surveillance 
program  may  be  based  upon  preproduction  or  early  production  missiles. 

5. 2  SYSTEM  SPECIFIC  CONSIDERATIONS. 

The  preceding  discussion  was  intended  to  provide  a  rather  brief 
overview  of  the  basic  phases  in  the  weapon  system  acquisition  process, 
the  principal  players  (frra  an  operational  tester's  viewpoint)  in  that 
process,  the  nature  of  their  activities,  and  the  resultant  data  available 
to  the  test  planner  or  test  analyst.  In  addition  to  those  aspects  of  the 
program,  there  are  considerations  which  are  more  system  specific.  These 
considerations  are  directly  related  to  the  specific  missile  system  hard¬ 
ware,  Its  intended  operating  environment,  both  the  operational  and  main¬ 
tenance  concepts,  and  the  missile  system's  projected  life  cycle  profile. 
A  sound  understanding  and  working  knowledge  of  each  of  these  areas  will 
be  required  to  effectively  project  dormant  reliability  at  an  acceptable 
level  of  confidence. 
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5.2.1  Hardware. 

A  thorough  understanding  of  the  hardware  being  tested  is  absolutely 
essential  to  the  effective  conduct  of  the  test.  For  reliability  testing 
and  assessment,  it  is  especially  important  that  the  current  design  be 
understood.  Furthermore,  the  specific  design  or  configuration  of  any 
element  of  the  missile  system  used  in  the  overall  test  program  must  be 
known.  The  more  detailed  knowledge  the  operational  tester  possesses 
about  the  new  missile  system,  the  greater  the  opportunity  to  relate  it  to 
a  similar  system,  even  if  the  comparison  occurs  at  the  subsystem  level. 
The  new  missile  may  not  be  like  any  existing  system,  but  its  subsystems 
may  be  similar  to  those  of  various  other  missile  systems  which  could 
provide  usable  data  for  initial  analyses  and  projections. 


5.2.2  Environment. 


The  operational  environment  to  which  the  missile  system  is  to  be 
subjected  can  be  a  critical  factor  relative  to  dormant  reliability. 
Failure  rates  have  been  shown  to  vary  with  stored  environment.  Since  the 
missile  is  likely  to  spend  the  vast  majority  of  its  life  in  a  dormant 
condition,  it  will  be  important  to  thoroughly  understand  the  environment 


in  which  it  is  dormant.  Further,  if  the  missile  is  to  transition  between 
various  environments  witnout  being  functionally  operative,  the  relative 
time  spent  in  each  environment]  and  some  understanding  of  the  manner  in 
which  the  missile  reached  each  environment  should  be  known.  Structuring 
a  comprehensive  test  to  effectively  account  for  various  environmental 
factors  will  require  knowledge  of  those  environments.  As  a  minimum,  the 


most  critical  environments  should  be  accounted  for  in  an  attempt  to 
provide  some  bounding  function  to  the  dormant  reliability  projections. 

5.2.3  Concept  of  Operation. 


It  can  be  stated  with  reasonable  assurance  that  accurate  prediction 
of  a  missile  system's  operational  reliability  without  knowledge  of  its 
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concept  of  operation  is  impossible.  There  can  be  no  doubt  that  such  a 
statement  can  be  made  if  the  objective  is  to  estimate  the  missile  sys¬ 
tem's  dormant  reliability  and  the  relative  impact  of  dormancy  on  oper¬ 
ational  reliability.  Recall  the  conceptual  definition  of  dormancy  as 
provided  in  section  III  and  particularly  in  figure  2.  Determination  of 
actual  conditions  and  periods  within  the  missile  system's  life  cycle 
which  constitute  dormancy  is  a  non-trivial  exercise.  It  must  be  uniquely 
developed  for  the  missile  system  under  consideration  at  the  subsystem 
level  within  the  context  of  the  concept  of  operations. 

5.2.4  Maintenance  Concept. 

The  preceding  paragraph  could  probably  be  repeated  here  with  no  loss 
of  impact  because  the  maintenance  concept  is  no  less  important  than  the 
operational  concept.  They  are  equal  partners  in  developing  the  missile 
system's  life  cycle  profile.  As  a  missile  or  a  missile  subsystem  cycles 
through  various  phases  as  portrayed  in  figure  6,  the  level  and  frequency 
of  maintenance  expected  to  be  performed  must  be  known.  For  example,  will 
continuous  monitoring  be  employed?  Will  the  missile  or  major  subsystems 
be  subjected  to  periodic  checkout  and  repair?  Will  some  form  of  wooden 
round  concept  be  employed?  These  questions  must  be  addressed  early  in 
the  planning  phase  if  an  adequate  test  program  is  to  be  developed.  If 
data  from  similar  missile  systems  or  subsystems  are  to  be  used  during 
early  reliability  prediction  activities,  then  it  will  be  necessary  to 
understand  the  maintenance  concept  employed  within  that  system. 

5.2.5  Life  Cycle  Profile. 

The  missile  system's  life  cycle  profile  provides  the  cornerstone 
upon  which  to  build  reliability  predictions.  Figure  6  depicts  a  simpli¬ 
fied  representation  of  two  typical  missile  system  life  cycle  profiles. 
They  very  simply  characterize  two  different  concepts:  no  maintenance  and 
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Figure  6.  Typical  Missile  System  Life  Cycle  Profiles 
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periodic  maintenance.  The  life  cycle  profile  for  a  specific  missile 
system  or  subsystem  will  be  tailored  to  that  system.  It  should  reflect 
as  accurately  as  possible  the  various  application  and  environmental 
states  within  which  the  missile  systems  will  reside,  the  sequence  of 
transition  among  states,  and  the  time  spent  in,  each  state.  Obviously, 
the  earlier  such  a  life  cycle  profile  is  constructed,  the  earlier  the 
operational  tester  will  be  able  to  develop  reliability  predictions, 
estimate  dormant,  reliability,  identify  sources  of  data,  provide  require¬ 
ments  for  system  testing,  and  identify  OT&E  test  sensitive  elements. 

The  level  of  detail  provided  in  the  life  cycle  profile  will  depend 
upon  the  level  of  detail  required  to  accurately  describe  the  specific 
missile  system.  In  general,  it  will  be  driven  by  the  operations  and 
maintenance  concepts  and  the  degree  to  which  it  is  desired  to  isolate 
failure  rate  data.  For  example,  assume  that  captive  carry  failure  data 
is  to  be  accounted  for  as  a  subset  of  failure  data  associated  with  trans¬ 
portation  and  handling.  Then  the  life  cycle  profile  should  reflect 
transportation  of  the  missile  to  the  aircraft  as  a  distinct  item  rather 
than  embedding  it  in  the  captive  carry  block. 

A  life  cycle  profile  tends  to  tie  the  system  specific  considerations 
and  concepts  into  a  picture  of  how  a  typical  missile  exists  over  a  long 
period  of  time.  A  life  cycle  profile  may  be  represented  by  state  dia¬ 
grams  defining  how  the  missile  is  planned  to  be  transitioned  from  one 
state  to  another,  or  by  simply  defining  the  various  possible  states  and 
allocating  the  proportion  of  time  spent  in  each  state. 

It  is  important  to  note  that  a  life  cycle  profile  for  a  missile 
system  at  one  location  or  Air  Force  base  may  be  quite  different  from  a 
profile  for  the  same  missile  system  at  another  location  or  base.  Pre¬ 
liminary  analysis  may  only  consider  a  "typical"  location  with  "typical" 
deployment  numbers,  etc.  Even  very  similar  missile  types  may  have  widely 
divergent  life  cycle  profiles  since  they  may  be  used  extensively  for 
training  exercises,  or  may  be  stored  in  different  configurations  or 
tested  in  different  ways. 
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A  good  example  of  the  divergence  in  life  cycle  profiles  between 
similar  missile  systems  is  provided  by  the  ALCM  and  GLCM  systems.  The 
ALCM  and  the  GLCM  are  nearly  identical  in  terms  of  missile  components  and 
electronics.  However,  their  deployment  policies,  methods  of  storage, 
maintenance,  and  checkout  concepts  are  quite  different.  It  stands  to 
reason,  therefore,  that  nearly  the  same  missile  flight  vehicle,  in  the 
ALCM  and  GLCM  case,  may  exhibit  quite  different  day-to-day  failure  char¬ 
acteristics.  A  further  delineation  of  the  life  cycle  profile  for  the 
ALCM  and  GLCM  may  illustrate  this  in  more  detail. 

5. 2.5.1  ALCM. 

The  proposed  operational  and  maintenance  concept  requires  the  ALCM 
to  be  stored  in  an  all  up  round  configuration  on  pylons  or  launchers  for 
long  periods  of  time.  Operational  readiness  or  verification  testing  will 
occur  on  a  yearly  cycle  basis.  It  can  be  estimated  that  an  average  ALCM 
can  easily  spend  greater  than  95  percent  of  its  life  in  a  dormant  state. 
The  dormant  reliability,  therefore,  becomes  of  great  importance  in  deter¬ 
mining  tue  overall  readiness  state  of  the  ALCM  weapon  system.  The  issue 
of  ALCM  dormant  reliability  becomes  even  more  important  under  the  pro¬ 
posed  operational  concept  of  transferring  ALCMs  directly  from  igloo 
storage  to  the  aircraft  and  performing  only  a  minimal  go/no-go  check 
before  aircraft  takeoff,  captive  carry,  and  ALCM  launch.  Most  likely, 
any  ALCM  failures  that  occur  in  storage  (and  after  verification  testing) 
will  not  be  detected  before  missile  launch.  .  Although  the  life  cycle 
profile  of  an  ALCM  indicates  that  an  average  ALCM  will  reside  in  a  dor¬ 
mant  state  most  of  its  life,  it  remains  in  igloo  (or  deep)  storage  only 
for  a  portion  of  its  non-operational  life.  ALCMs  on  pylons  or  rotary 
launchers  are  placed  on  aircraft  standing  alert  for  as  long  as  three- 
month  periods.  Thus,  an  ALCM  on  a  pylon  may  be  exposed  to  runway  temper¬ 
ature  and  environment  variations  for  long  periods.  Fully  loaded  pylons 
or  launchers  are  also  continually  being  transported  between  and  about 
igloo  storage  areas,  the  integrated  maintenance  facility  (IMF)*  and  the 
flightline  alert  areas. 
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The  major  states  in  which  an  ALCM  will  reside  can  be  defined  as 
igloo  storage,  IMF  storage,  captive  inactive  (alert  status),  ground 
active  (being  tested  with  an  electronic  system  test  set),  captive  active, 
and  free  flight.  Note  that  these  definitions  are  in  consonance  with  the 
ALCM  test  program  and  are  not  in  the  same  terms  as  the  definitions  in 
section  III,  although  they  are  relatable.  Transition  between  states 
usually  requires  a  transportation  activity.  Based  upon  estimates  of  how 
many  ALCMs  on  an  average  Air  Force  base  are  in  each  state  at  e  random 
point  in  time,  the  amount  of  time  an  average  ALCM  spends  in  each  state 
may  be  estimated.  For  instance,  if  a  base  is  allocated  192  all  up  rounds 
(AURs)  that  include  warheads,  and  23  unarmed  (spare)  ALCMs,  the  opera¬ 
tional  and  maintenance  concepts  indicate  that  at  a  random  point  in  time 
there  will  be  an  average  of  60-72  AURs  on  flightline  alert  (captive 
inactive),  about  5  AURs  and  2  unarmed  ALCMs  residing  in  the  IMF,  115-127 
AURs  in  igloo  storage,  and  21  spare  ALCMs  in  unarmed  storage.  One  or  two 
AURs  in  the  IMF  will  be  under  test  (ground  active)  at  any  random  point  in 
time.  Since  the  total  population  of  ALCMs  at  a  base  will  be  regularly 
cycled  through  igloo  storage,  flightline  alert,  IMF,  and  unarmed  storage, 
an  average  ALCM  will  spend  approximately  the  following  percentage  of  its 
life  in  the  indicated  states: 

a)  Igloo  storage  -  53  to  59  percent 

b)  Flightline  alert  -  28  to  33  percent 

c)  IMF  inactive  -  2  to  3  percent 

d)  IMF  active  -  .5  to  1  percent 

e)  Unarmed  storage  -  10  percent 

f)  Captive  carry  (Active)  -  less  than  1  percent 

g)  Free  flight  -  much  less  than  1  percent. 

5. 2.5.2  GLCM. 

The  proposed  GLCM  operational  and  maintenance  concept  indicates  that 
the  GLCM  will  be  handled  quite  differently  from  the  ALCM.  The  GLCM,  with 
associated  rocket  booster,  will  be  stored  as  an  all  up  round  (AUR)  in  a 
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chemically  inert  environment  inside  pressurized  canisters.  Canisters 
will  be  mounted  on  transporter  erector  launchers  (TELs)  and  stored  in 
igloos  at  an  Air  Force  base.  Although  it  is  currently  unclear  whether 
GLCMs  will  be  powereo  during  an  alert  cycle,  it  is  possible  that  a  GLCM 
may  never  have  power  applied  to  it,  even  for  test  purposes,  after  the 
initial  certification  check  at  the  base.  Thus,  the  GLCM  can  be  looked 
upon  as  much  closer  to  a  wooden  round  than  the  ALCM.  However,  since  TELs 
will  be  moved  at  regular  intervals  for  TEL  maintenance  and  training,  GLCM 
AURs  will  be  dismounted  and  mounted  somewhat  frequently.  The  current 
maintenance  concept  calls  for  the  GLCM  AUR  to  be  sent  to  depot  maintenance 
for  overhaul  and  recertification  every  three  years. 

In  normal  day-to-day  peacetime  operations,  a  GLCM  will  reside  totally 
in  an  environmentally  benign  igloo  or  IMF  storage  area  (the  alert  area 
may  be  considered  igloo  storage).  However,  if  a  failure  occurs  during 
storage,  only  a  minimal  possibility  of  detection  exists  before  the  three 
year  depot  recertification  cycle  occurs. 

When  considering  the  life  cycle  profiles  for  both  the  ALCM  and  GLCM, 
the  probability  of  obtaining  an  operational  (nort-failed)  missile  at  a 
specific  point  in  time  will  most  likely  be  quite  different  for  each 
missile.  Furthermore,  that  probability  will  be  dependent  upon  different 
factors.  For  the  ALCM,  the  probability  is  dependent  upon  factors  such  as 
flightline  alert  environment,  probability  of  failure  detection  during 
recertification  tests,  and  stress  levels  during  power  on/off  situations, 
among  others.  For  the  GLCM-,  the  probability  is  more  a  function  of  the 
upload/download  or  transportation  stress,  inherent  aging  effects  and 
manufacturing  quality  control.  . 

5. 3  TEST  AND  EVALUATION  CONSIDERATIONS. 

An  overall  concept  of  dormant  reliability  testing  was  introduced  in 
the  preceding  section.  Particular  attention  was  given  to  techniques 
employed  by  the  missile  system  developer  early  in  the  missile  system's 
life  cycle.  This  section  will  focus  on  that  portion  of  the  overall 
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system  test  program  which  is  of  principal  concern  to  the  operational 
tester— OTiE.  Some  particular  considerations  which  are  of  interest  to 
the  operational  tester  include  inherent  limitations  in  the  QT&E  process, 
the  role  of  sampling  and  its  relationship  to  QT&E,  methodologies  for 
projecting  mature  missile  system  dormant  reliability  based  upon  OT&E 
results,  and  capabilities  for  verifying  or  establishing  the  validity  of 
early  reliability  predictions. 

5.3.1  Test  Limitations. 

Major  limitations  in  an  OT&E  program  can  generally  be  classified  as 
resource  related.  Time  and  test  assets  comprise  the  principal  cate¬ 
gories.  Seldom,  if  ever,  is  there  sufficient  time  (from  the  tester's 
perspective)  to  accomplish  a  thorough  and  adequate  OT&E  program.  This 
tends  to  be  a  more  severe  problem  for  IOT&E  than  for  FOT&E ,  hence  a 
specific  AFTEC  concern.  If  the  time  available  for  assessing  the  opera¬ 
tional  effectiveness  of  the  missile  system  is  not  considered  sufficient, 
there  can  be  no  -.oubt  that  determining  the  effects  of  dormancy  from  test 
data  will  be  extremely  difficult.  It  reemphasizes  the  need  for  early 
involvement  and  identification  of  resources  necessary  to  accomplish  the 
test  program.  Even  with  early  participation,  there  will  be  limited 
assets  available  for  the  test  program,  particularly  for  dormant  reli¬ 
ability  testing.  Both  the  quantity  and  the  quality  of  available  test 
articles  can  limit  the  effectiveness  of  the  OT&E  program.  In  addition  to 
the  limited  number  of  missiles  available  for  testing,  those  available 
during  IOT&E  are  generally  preproduction  models  which  may  exhibit  failure 
modes  and  rates  not  representative  of  the  ultimate  production  version. 
While  these  potential  problem  areas  will  not  likely  be  eliminated,  they 
may  be  somewhat  mitigated  through  careful  planning  and  evaluation. 

5.3.2  Sampling. 

It  Is  not  feasible  to  obtain  failure  rate  measurements  on  entire 
populations  of  missile  systems.  Therefore,  it  is  understandable  that  the 
techniques  of  reliability  measurement  rest  upon  statistl cal  concepts. 
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Such  techniques  permit  the  extrapolation  of  results  obtained  from  a 
sample  to  the  total  population  and  possibly  to  other  similar  populations. 
Whether  testing  for  operating  or  dormant  reliability,  it  is  necessary  to 
determine  whether  or  not  the  missile  system  meets  specified  criteria. 
Selection  of  an  appropriate  sample  of  missile  systems  for  testing  depends 
upon  the  hypothesis  to  be  addressed  and  the  potential  risks  associated 
with  accepting  or  rejecting  the  test  results.  These  considerations  are 
discussed  in  more  detail  in  annex  D. 

Determination  of  the  test  sample  size  also  depends  upon  the  test 
method  to  be  employed.  Two  commonly  used  methods  for  dormant  reliability 
testing  are  fixed-length  tests  and  tests  truncated  after  a  spec,  ied 
number  of  failures.  Within  each  method,  testing  can  be  accomplished 
either  with  or  without  replacement.  Under  a  replacement  concept,  failed 
test  items  are  either  replaced  with  new  ones  or  they  are  repaired  and 
returned  to  the  sample  for  further  testing.  Within  a  fixed  time  test, 
testing  with  replacement  is  most  commonly  used;  it  generally  requires 
fewer  samples. 

5.3.3  Projection  Methodologies. 

It  has  been  pointed  out  that  the  issue  of  dormant  reliability  is 
part  of  a  substantially  larger  problem— projecting  mature  missile  system 
reliability  early  in  the  missile  system's  life  cycle.  There  are  two 
aspects  to  the  projection  problem,  although  the  difference,  while  real 
may  be  very  subtle.  There  must  be  an  initial  estimate  of  system  reliabil¬ 
ity  while  subsequent  projections  tend  to  be  refinements  of  previous 
projections.  Several  projection  methodologies  are  available  (see  Projec¬ 
tions  of  Suitabi lity  OT&E  Results  to  Mature  System  Operations.  BOM/A-81- 
052-TRj  depending  on  the  missile  system  development  phase. 

During  the  planning  phase,  methodologies  will  generally  be  restricted 
to  those  which  can  use  non-measurement  or  limited  part  test  data.  Con¬ 
tractor  predictions,  judgement,  comparability  analyses,  and  simulation/ 
modeling  will  provide  the  primary  tools.  During  IOT&E,  as  test  results 
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become  available,  regression,  Gompertz,  and  surveillance  and  inspection 
methods  can  be  added.  These  varied  methodologies,  with  the  exception  of 
contractor  predictions,  will  still  be  applicable  during  FQT&E. 

5.3.4  Validation  and  Verification. 

Validation  and  verification  of  reliablity  projections  is  a  difficult 
and  often  time  consuming  task.  By  its  very  nature,  "proving"  estimates 
of  dormant  reliability  is  non- trivial.  Field  results  will  quite  often 
require  5  to  10  years  of  exhaustive  measurement,  data  collection,  and 
analysis  before  dormant  reliability  predictions  can  be  verified.  Since 
the  verification  process  provides  the  empirical  feedback  necessary  to 
help  validate  the  reliability  projection  methodology,  the  validation 
process  is  also  accomplished  over  an  extended  period  of  time.  Expe¬ 
rience,  of  course,  can  be  an  integral  factor  for  both  validation  and 
verification.  Data  from  similar  systems  can  be  used  in  the  process 
provided  that  the  analyst  correctly  assesses  the  applicability  of  that 
data. 
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SECTION  ,VI 

TOOLS  AND  TECHNIQUES  FOR  POTENTIAL  AFTEC  APPLICATION 

6.1  AVAILABILITY  AND  APPLICABILITY. 

It  is  clear  from  previous  sections  that  tools  and  techniques  for 
estimating,  predicting,  projecting,  or  assessing  dormant  reliability 
during  OT&E  are  limited  in  terms  of  both  their  availability  for  use  and 
their  direct  applicability  in  terms  of  the  inherent  limitations  and  bias 
associated  with  differing  goals  in  the  development  process.  The,  only 
logical  course  to  pursue,  then,  is  to  take  the  best  that  is  available, 
modifying  where  possible,  or  to  suggest  new  methods  which  could  be  pursued 
in  the  future. 

6.2  INITIAL  ESTIMATES. 

6.2.1  MIL-HDBK-217C. 

MIL-HDBK-217C  contains  the  most  widely  used  methods  for  initial 
estimates  of  reliability.  As  discussed  earlier,  it  applies  mainly  to 
electronic  components  at  the  piece  part  level.  There  are,  however,  some 
considerations  which  may  render  this  approach  useful  for  projection 
purposes. 

First  of  all,  the  MIL-H0BK-217C  methods  result  in  an  inherent  dormant 
reliability  prediction  which  is  generally  not  applicable  to  field  condi¬ 
tions  (because  of  type  2  and  type  6  failures).  However,  as  in  the  discus¬ 
sion  of  the  definition  of  dormancy,  the  operationally  ready  storage 
subset  may  actual 1y  represent  this  inherent  failure  rate  condition, 
depending  on  the  level  of  maintenance  and  test/checkout.  In  these  cases, 
the  contractor  prediction  could  be  used  directly.  If  significant  main 
tenance  exists,  then  the  contractor  prediction  should  be  adjusted  * 
type  2  and  6  failures.  An  initial,  approximate  "rule  of  thumb"  for  this 
condition  is  that  total  failures  are  approximately  twice  the  inherent  or 
type  1  failures. 
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A  second  and  very  important  consideration  is  that  dormant  reliability 
should  be  addressed  at  the  subsystem  level.  When  one  realizes  that  a 
complete  (typical)  tactical  missile  can  be  represented  by  less  than  50 
part  types,  it  becomes  fairly  obvious  that  "building  up"  a  particular 
subsystem  from  parts  would  not  be  particularly  difficult  or  time  consum¬ 
ing.  If  a  subsystem  parts  list  could  be  obtained  from  the  SPO/development 
contractor,  an  AFTEC  analyst  could  perform  the  necessary  MIL-HDBK-217C 
operations  within  a  day.  Although  AFTEC  has  generally  not  been  involved 
at  the  piece  parts  level,  in  some  situations  it  might  be  well  worth 
considering.  This  is  particularly  true  in  missile  systems  since  the 
number  of  major  subsystems  range  from  about  6  for  an  air-to-air  missile 
to  about  13  for  a  cruise  missile,  with  only  a  few  of  these  being  elec¬ 
tronic  in  nature. 

6.2.2  Piece  Parts  for  Non-Electronics. 

Part  reliabilities  and  piece  part  methodologies  for  other  than 
electronic  devices  are  available  in  RADC  and  Army  Missile  Command  hand¬ 
books.  The  "parts"  tend  to  be  aggregated  at  higher  levels  than  those  of 
tho  MIL-H0BK-217C  listings  (e.g. ,  generators,  pumps,  actuators,  regu¬ 
lators,  rocket  engines,  valves).  Thus,  a  buildup  approach  is  further 
simplified.  The  drawbacks  to  these  documents  are  that  they  have  not 
received  "MIL  STO"  status,  as  such,  and  are  slightly  harder  to  procure. 
They  are,  however,  in  current  common  usage. 

6.2.3  Piece  Part  Surrogates. 

If  very  quick  estimates  are  necessary,  there  are  several  estimating 
relationships  which  have  been  used  in  the  past.  These  estimating  rela¬ 
tionships  essentially  provide  a  surrogate  for  an  aggregated  parts  level. 
Surrogate  measures  include  such  things  as  complexity,  volume,  weight, 
function,  and  cost.  Simple  or  weighted  averages  could  also  be  substituted 
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for  an  actual  parts  count.  Surrogate  methods  provide  only  a  gross  estima¬ 
tion  of  reliability  and  are  generally  used  for  very  quick  trade-off 
analyses  by  system  developers.  Documentation  on  these  methods  is  vir¬ 
tually  non-existent  for  obvious  reasons. 

6.2.4  Piece  Part  Computer  Codes. 

Almost  every  organization  involved  with  piece  part  methodologies 
will  generally  have  a  simple  computer  code  or  "model"  which  does  the 
"look-up"  and  computations  involved.  In  late  1975  and  1976,  AFTEC/OAO 
investigated  one  such  code  called  "Predictor."  The  original  code  was 
developed  by  R/M  Systems,  Inc.  under  subcontract  to  The  BDM  Corporation 
for  AFTEC.  Preliminary  investigation  indicated  that  the  use  of  this  code 
to  "look-up"  and  accumulate  part  failure  rates  and  the  associated  mainte¬ 
nance  man-hours  could  produce  manpower  predictions  in  the  range  of  within 
10  percent  of  other  methods.  In  addition,  Some  surrogate  methods  were 
included  for  aggregating  "the  parts"  at  subsystem  level.  Because  the 
weapons  systems  under  consideration  at  that  time  could  be  "measured,"  and 
only  operating  systems  were  being  tested,  the  development  effort  associ¬ 
ated  with  such  a  code  was  not  really  necessary.  For  this  and  a  variety  of 
other  reasons  the  pursuit  of  such  a  methodology  was  gradually  dropped. 

The  point  to  be  made  here  is  that  dormant  reliability  estimates 
(given  that  "measurement"  is  difficult)  could  be  enhanced  by  a  similar 
type  of  code  using  existing  dormant  data  bases  with  refinement  over  time. 
More  consideration  on  the  relative  value  of  such  a  development  or  col¬ 
laboration  with  other  agencies  toward  a  similar  end  is  warranted. 

6.2.5  Comparability  Analysis. 

Comparability  analysis  is  a  recognized  technique  that  has  been  used 
with  success  in  the  past  by  AFTEC.  There  are,  however,  some  constraints. 
The  data  base  used,  the  skill  of  the  person  making  the  comparability 
decisions,  various  adjustments  that  must  be  made  when  100  percent 
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comparable  data  do  not  exist  (the  general  and  most  frequent  case),  and 
the  ingenuity  of  the  analyst  applying  the  results  are  all  limiting  fac¬ 
tors.  Even  with  these  caveats,  however,  comparability  analysis  is  probably 
the  single  best  technique  that  can  be  used  when  firm  reliability  values 
based  on  actual  system  experience  and  data  are  not  available. 

This  approach  requires  detailed  knowledge  of  the  specific  missile 
system  under  consideration  as  well  as  all  other  systems/subsystems  which 
may  be  similar.  One  advantage  in  performing  comparability  analysis  on  a 
missile  system  is  that  similarities  are  often,  the  rule  rather  than  the 
exception,  especially  within  a  missile  series.  Figure  7  provides  an 
example  of  a  top-level  comparison  of  the  AIM-9  series.  Even  outside  of  a 
series,  the  chances  are  good  that  some  subsystems  will  have  directly 
comparable  counterparts  in  other  missile  systems,  aircraft,  RPVs,  etc. 
because  the  technology  just  does  not  change  that  fast. 

Given  that  comparable  or  similar  subsystems  exist,  the  problem  then 
becomes  one  of  homing  in  on  dormant  reliability  by  subsystem.  If  data  on 
dormancy  for  the  similar  systems  do  not  exist,  one  is  left  with  factoring 
operating  failures  to  dormant  failures,  and  this  process  is  generally  not 
very  accurate  (see  paragraph  6.2.6).  The  need  to  collaborate  with  other 
agencies  who  maintain  dormant  data  bases  thus  becomes  patently  obvious. 

6.2.6  K  Factors. 

A  K  factor  is  an  adjustment  from  one  condition  or  set  of  conditions 
to  other  conditions.  In  the  general  sense,  the  terra  adjustment  factor  is 
more  appropriate,  but  the  use  of  the  designator  "R"  has  become  common  to 
reliability  engineering  and  reliability  handbooks. 

It  is  impossible  to  generalize  the  applicability  or  validity  of 
adjustment  factors.  First  of  all,  the  number,  type,  and  application  of 
adjustment  factors  is  almost  limitless.  Secondly,  the  validity  depends 
upon  the  application  Itself.  The  use  of  adjustment  factors  tends  to  be 
more  art  than  science  and  is  therefore  Strongly  Influenced  by  the  skill. 
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Figure  7.  Comparison  of  the  Various  Sidewinder  Types  with  the  AIM-9  B 
Sidewinder  IA  (taken  from  International  Defense  Review, 
Special  Series  10,  1980,  without  modification) 
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expertise,  experience,  and  ingenuity  of  the  person  using  them.  Indis- 
crirainant  or  uninformed  use  of  adjustment  factors  is  certainly  less  than 
prudent.  In  many  cases,  adjustment  factors  have  been  backfitted  to  data 
sets  or  applied  to  "get  the  right  answer"  or  meet  specification.  This 
practice  has  obviously  done  nothing  to  enhance  the  acceptance  of  adjust¬ 
ment  factors  as  a  valid  analytical  tool. 

The  fact  is  that  adjustment  factors  have  been  employed  to  accurately 
replicate  reality  and  to  project  or  predict  future  states.  Comparability 
analysis,  for  instance,  almost  always  includes  some  sort  of  adjustment, 
even  if  it  is  judgmentally  derived.  In  some  cases  (as  in  early  estimates 
of  dormant  reliability),  adjustment  factors  are  the  only  possible  alterna¬ 
tive,  but  extreme  care  should  be  exercised  in  using  them. 

The  adjustment  factors  in  reliability  handbooks  are  fairly  good  if 
the  user  has  an  understanding  of  the  application  and  meaning  of  the 
results,  and  if  used  they  are  within  the  strict  confines  of  the  method¬ 
ologies.  MIL-HDBK-217C,  for  instance,  gives  the  following  caveat  in  bold 
type: 


CAUTION 

THE  FAILURE  RATES  PRESENTED  APPLY  TO  EQUIPMENT  UNDER 
NORMAL  OPERATING  CONDITIONS,  i.e. ,  WITH  POWER  ON  AND 
PERFORMING  ITS  INTENOED  FUNCTIONS  IN  ITS  INTENDED 
ENVIRONMENT.  EXTRAPOLATION  OF  ANY  OF  THE  BASE  FAILURE 
RATE  MOOELS  BEYONO  THE  ;A8ULATED  VALUES,  SUCH  AS  HIGH 

or  Sub-zero  temperature,  or  electrical  stress  values 

A80VE  1.0  OR  AT  0  OR  EXTRAPOLATION  OF  ANY  ASSOCIATED 
MODIFIERS  IS  COMPLETELY  INVALID. 

While  adherence  to  this  caution  is  recommended,  the  latest  update  of 
MIL-H08K-217C  contains  as  part  of  its  documentation  an  environmental 
factors  survey  which  shows  some  promise  for  application  at  above  the 
piece  part  level.  A  delphi  technique  was  employed  to  survey  experts  in 
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the  reliability  field  who  were  asked  to  establish  an  order  of  significance 
for  factors  in  various  use  environments.  In  addition,  the  expertise  of 
each  respondent  was  also  rated  and  limited  field  data  were  included  where 
possible.  The  results  of  this  survey  are  provided  in  figure  8.  The 
manner  in  which  the  survey  was  conducted  and  its  apparent  generality  give 
some  credence  to  the  possible  use  of  these  factors  as  adjustments  at  the 
subsystem  level.  Please  note  that  the  nonoperating  environment  listed  in 
figure  8  follows  the  definition  given  in  the  update  to  MIL-HDBK-217C;  it 
is  not  necessarily  the  same  as  dormant  as  defined  in  this  report.  It  is, 
in  fact,  closer  to  operationally  ready  storage  (with  no  operating/test 
equipment  stress  applied)  or  inherent  dormant  reliability.  If  the  in¬ 
herent  dormant  reliability  of  a  missile,  by  subsystem,  can  be  measured  or 
predicted,  then  these  environmental  factors  could  be  used  to  adjust  this 
value  to  those  for  different  dormancy  states  (transportation,  launcher 
carriage,  captive  carry,  etc.)  as  a  "ball  park"  estimate. 

Another  adjustment  factor  worthy  of  some  discussion  is  laboratory  (a 
contractor  estimated)  reliability  to  field  reliability.  AFTEC  has  suc¬ 
cessfully  used  this  adjustment  in  LCOM  simulations  of  aircraft  systems. 
This  success,  however,  is  strongly  related  to  knowledge  and  experience 
with  aircraft  systems  in  general,  and  good  historical  data  for  compar¬ 
ability  analysis  in  particular.  Adjusting  for  type  2  and  type  6  failures 
is  possible  for  dormant  missile  systems,  especially  when  comparable  field 
data  are  available  or  if  the  development  contractor's  "censoring"  of 
non-relevant  failures  can  be  closely  monitored  and  tracked.  Gross-level 
extrapolations  from  laboratory  to  field  reliability  without  some  insight 
Is  risky  at  best. 

Several  studies  available  In  current  literature  attempt  to  adjust 
from  operating  to  non-operating  conditions.  This  particular  adjustment 
appears  to  have  very  limited  potential  application  unless  accomplished 
(with  great  caution)  at  the  piece  part  level.  Results  vary  widely  and 
there  appears  to  be  no  universal  application.  Use  of  a  system-  or  sub- 
system-level  adjustment  for  operating  to  non-operating  failure  rates 
should  be  used  only  as  a  last  resort,  at  least  until  much  more  research 
has  been  accomplished. 
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Figure  8.  Environmental  Severity  Ratios  and  Influence  Matrix 
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At  a  more  detailed  level,  failure  modes  and  effects  analysis  could 
be  used  to  advantage.  Where  the  non-operating  failure  modes  are  the  same 
as  the  operating  failure  modes,  adjustments  might  be  possible  based  on 
stress  ratios  or  similar  estimating  relationships.  It  might  also  be 
possible  to  correlate  how  malfunctioned  codes  from  comparable  data  to 
failure  modes.  (More  investigation  is  necessary  here.)  Where  operating 
failure  modes  are  very  different  from  non-operating  failure  modes--as  is 
the  case  for  turbine  engines— then  no  direct  adjustment  or  factoring 
should  be  attempted. 

6.2.7  Other  Estimating  Techniques. 

There  are  several  additional  estimating  techniques  which  have  poten¬ 
tial  for  AFTEC  application  to  the  dormancy  problem,  but  for  the  most  part 
they  are  not  proven  and  should  be  viewed  only  as  possibilities.  These 
techniques  are  based  on  adaptation  or  extrapolation  of  contractor  screen¬ 
ing  and  testing.  Each  technique  is  discussed  relative  to  the  appropriate 
contractor  activity. 

6. 2. 7.1  Estimates  from  Acceptance  Testing. 

In  the  ideal  sense,  acceptance  testing  should  eliminate  all  defective 
missiles/missile  subsystems  prior  to  delivery  to  the  customer.  In  a 
pragmatic  sense  however,  this  is  rarely  100  percent  true  and  close  exam¬ 
ination  of  the  testing  methods  and  equipment  should  be  accomplished.  An 
estimate  from  the  development  contractor  regarding  the  test  efficiency  or 
type  1  error  (probability  of  accepting  a  defective  item)  rhould  be  re¬ 
quested  as  early  as  possible.  Expert  judgment  and  comparable  experience 
can  also  be  used  to  back  up  the  contractor's  estimate.  This  estimate  is 
vital  (even  if  there  is  no  clear-cut  way  of  arriving  at  a  figure)  because 
it  is  used  to  predict  undetected  failures  entering  the  field  environment. 
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6. 2. 7. 2  Estimates  from  Accelerated  Stress  Testing. 

If  accelerated  stress  tests  are  conducted  at  different  stress  levels 
and  sufficient  stress  tests  are  conducted  to  compute  an  MTBF  at  each 
stress  level,  then  regression  techniques  can  be  employed  to  estimate 
inherent  dormant  reliability  by  extrapolating  backwards  to  zero  stress 
and  computing  the  corresponding  MTBF.  A  hypothetical  example  is  provided 
in  figure  9. 

If  this  methodology  is  to  be  employed,  AFTEC  involvement  early  in 
the  development  process  is  essential  to  ensure  that  sufficient  tests  are 
accomplished  at  varying  stress  levels. 

In  addition  to  a  prediction  of  inherent  dormant  reliability  (zero 
stress),  it  may  also  be  possible  to  directly  correlate  stress  tests  at 
low  power  levels  to  the  dormant  reliability  expected  at  those  same  stress 
levels,  i.e. ,  guidance  systems  in  ICBMs  maintained  at  X  percent  stress 
continuously,  or  the  stress  level  induced  by  test  equipment  (if  less  than 
fully  operating). 

6. 2. 7. 3  Estimates  from  Accelerated  Temperature  Cycling. 

It  is  generally  accepted  that  accelerating  temperature  cycles  can  be 
used  to  replicate  the  aging  process.  Some  doubt  doei  remain,  however,  as 
to  the  relative  contribution'  of  seasonal  temperatire  variation  versus 
actual  aging  (additional  research  is  indicated).  6  ven  that  the  concept 
holds,  accelerated  temperature  cycling,  if  conducted  at  the  subsystem 
level,  could  be  used  directly  as  an  estimate  of  inherent  dormant  reliabil¬ 
ity  by  factoring  the  failure  rate  observed  during  tests  by  the  age  accel¬ 
eration  ratio.  The  validity  of  the  ratio  between  the  accelerated  time 
and  real  time  is  the  critical  Issue.  This  method  has  been  used  by  the 
Naval  Ordnance  Station  at  Indian  Head,  Maryland  on  rocket  motors.  It 
should  be  equally  applicable  to  warheads  and  othur  systems  where  age 
related  failure  modes  are  indicated. 
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6. 2. 7. 4,  Shelf  Life  Estimates. 

Subsystems  such  as  solid  rocket  motors  and  warheads  exhibit  dormant 
reliability  characteristics  which  are  analogous  to  shelf  life  in  that 
they  are  generally  perishable  and  cannot  be  repaired  or  returned  to  their 
original  specifications.  In  addition,  these  systems  do  not  experience 
intermittent  or  periodic  operation.  Thus  aging,  which  is  the  predominant 
factor  in  shelf  life,  applies.  The  actual  rate  of  chemical  decomposition 
can  be  computed  for  explosives  and  propellants.  However,  these  sub* 
systems  tend  to  have  very  long  dormant  lives.  Hence  the  contractor's 
estimate  of  shelf  life  or  comparability  data  from  the  Naval  Ordnance 
Station  at  Indian  Head,  Maryland  should  be  sufficient  as  an  estimate  of 
dormant  reliability.  Another  necessary  consideration  is  that  packaging 
influences  shelf  life.  If  the  protection  from  the  environment  is  dif¬ 
ferent  than  that  afforded  by  the  packaging  associated  with  shelf  life 
predictions,  then  an  adjustment  based  on  environmental  severity  (i.e. , 
humidity,  temperature,  salt,  fog,  etc.)  should  be  considered. 

6. 2. 7. 5  Estimates  from  Vibration  Testing. 

The  development  contractor  will  normally  perform  various  types  of 
vibration  testing  as  a  screen.  With  careful  consideration  of  the  vibra¬ 
tion  test  itself  and  actual  conduct  of  the  test  under  the  proper  condi¬ 
tions,  it  might  be  possible  to  derive  factors  for  the  various  inodes  of 
dormancy  where  vibration  is  experienced  such  as  transportation  and  hand¬ 
ling,  launcher  carriage,  and  captive  carry.  Major  problems,  however, 
could  be  anticipated  in  that  to  properly  use  this  test  as  a  predictor  for 
dormancy,  the  test  should  be  conducted  with  "power  off.”  Actual  measure¬ 
ment  of  when  failures  occurred  is  then  impossible.  Proper  sample  size 
selection  and  a  relatively  large  number  of  tests  at  various  fixed  lengths 
of  time  could  be  used  to  statistically  determine  failure  rates  from 
vibration  testing. 
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6. 2. 7. 6  Estimates  from  Power  on/Power  off  Cycling. 

The  use  of  power  on/off  cycling  has  been  used  in  several  studies  to 
predict  dormant  reliability  (see  reference  18).  Results  vary  widely  and 
its  applicability  appears  to  be  relevant  only  at  the  piece  part  level. 
The  comments  regarding  adjustment  factors  for  operating  to  nonoperating 
also  apply. 

One  aspect  of  power  on/off  cycling  is  extremely  useful.  Dormant 
systems  may  experience  various  power-on  cycles  due  to  test  equipment  or 
maintenance  and  other  aspects  of  the  concept  of  operations.  This  periodic 
turn  on/off  will  influence  dormant  reliability  in  a  synergistic  manner  as 
previously  discussed.  The  failure  rate  from  power  on/off  cycling  should 
be  applied  to  the  system's  life  cycle  profile  in  terms  of  on/off  cycles 
to  failure  every  time  the  system  is  tested  or  otherwise  "turned  on." 
This  will  assist  in  capturing  all  of  the  synergistic  relationships  inher¬ 
ent  in  the  dormancy  problem. 

Another  very  practical  use  (in  an  estimating  sense)  is  that  it  could 
be  used  directly  as  a  surrogate  for  the  failures  induced  by  test  equipment 
or  maintenance  by  equating  the  number  of  such  events  to  the  number  of 
power  on/off  cycles. 

6.2.8  Initial  Estimating  Techniques  -  Overview. 

The  techniques  for  initial  estimates  of  dormant  reliability  are 
primarily  aimed  at  predicting  inherent  dormant  reliability  except  as 
noted  in  previous  paragraphs  and  in  table  1  which  follows.  Inherent 
dormant  reliability  (by  estimation  and  test)  is  the  central  and  most 
critical  building  block  of  the  overall  assessment  approach  which  is 
outlined  in  section  VIII.  Table  1  provides  a  brief  mnemonic  for  each 
estimating  technique,  the  form  of  the  resulting  estimate,  and  an  assess¬ 
ment  of  the  utility  to  AFTEC,  estimated  in  terms  of  soundness,  useability, 
and  accuracy  of  the  approach. 
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6.3  PROJECTIONS  TO  MATURITY. 

Projection  methodologies  are  addressed  in  paragraph  5.3.3  and  in 
detai 1  i n  Projections  of  Suitability  OT&E  Results  to  Mature  System  Opera¬ 
tions,  BDM/A-81-052-TR.  The  projection  methodologies  in  the  above  ref¬ 
erence  are  generally  applicable  to  dormant  reliability  • as  long  as  the 
nature  of  dormancy  is  carefully  considered  as  part  of  the  process. 

In  the  ideal  case,  inherent  dormant  reliability,  operationally  ready 
storage  reliability,  and  dormant  reliability  by  state  (transport,  captive 
carry,  etc.)  should  be  closely  monitored  from  the  first  estimates  and 
specifications  forward  to  essentially  plot  a  "bathtub  curve."  The  nature 
of  dormancy  and  the  missile  system  development  process  are  such  that  one 
would  expect  to  see  reliability  changes  appear  in  "spurts"  or  by  lot. 
Thus  reliability  growth  curves  should  look  more  like  step  functions  than 
smooth  curves. 

Another  aspect  of  the  nature  of  dormancy  which  is  critical  in  this 
regard  involves  the  definition  itself.  Refer  to  section  III;  note  that 
the  definition  of  dormant,  in  part,  requires  an  AUR  and  allows  only 
on-equipment  maintenance.  Thus,  parts  and  even  subsystems  in  storage  and 
off-equipment  maintenance  have  been  excluded  from  the  "aging"  process. 
Although  there  were  very  good  reasons  for  doing  this,  it  is  important  to 
consider  its  impact  on  projections  to  maturity.  As  missiles  mature  and 
begin  to  require  maintenance  for  dormant  failures,  it  is  likely  (depend¬ 
ing  on  the  sparing  policy)  that  "old"  parts  are  used.  These  parts  could 
then  also  be  experiencing  age  related  failures.  One  might  then  begin  to 
see  an  artificially  early  wear  out  of  the  system  by  repairing  with  parts 
that  are  more  likely  to  fail  due  to  their  own  age. 


6.4  TESTING  FOR  DO 


RMANT  RELIABILITY. 


The  nature  of  the  dormancy  problem,  as  discussed  in  section  II,  is 


such  that  traditi 
There  are  a  few 


onal  test  means  and  methodologies  often  do  not  apply, 
types  of  tests,  however,  that  can  be  conducted  by  the 
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development  contractor  and  by  AFTEC  during  OT&E.  Appropriate  testing 
methods  and  specific  experience  for  those  methods  were  addressed  in  para' 
graphs  4.1  and  4.2.  Those  listed  in  the  state  of  the  art/experience  plus 
others  which  are  deemed  appropriate  are  included  in  this  section.  An 
overview  of  the  general  types  of  tests  that  can  be  conducted  is  provided 
in  figure  10. 

Given  that  only  certain  types  of  tests  are  appropriate  in  a  general 
sense,  it  is  necessary  to  further  subdivide  these  possiblities  by  sub¬ 
system  type.  Certain  types  of  subsystems  (rocket  motors  versus  guidance 
units,  for  instance)  are  amenable  to  only  certain  types  of  tests.  A 
discussion  of  this  subject  is  provided  in  paragraph  6.4.1. 

Finally,  from  the  OT&E  perspective,  it  is  necessary  to  determine 
which  tests  should  be  conducted  by  the  development  contractor  and  moni¬ 
tored  by  AFTEC  and  which  tests  should  be  conducted  by  AFTEC  during  OT&E. 
These  decisions  must  be  keyed  to  a  specific  missile  life  cycle  profile. 
A  discussion  of  this  subject  is  provided  in  paragraphs  6.4.2  and  6.4.3. 

6.4.1  Testing  Considerations  by  Missile  Subsystem. 

Individual  missile  subsystems  by  their  very  nature  are  not  amenable 
to  all  tests.  For  Instance,  power  on/power  off  tests  on  rocket  motors 
and  warheads  is  obviously  not  appropriate,  whereas  it  is  appropriate  for 
guidance  units.  Table  2  provides  a  summary  of  the  generic  test  types 
that  are  most  appropriate  for  missile  systems,  broken  out  by  four  sub¬ 
system  types..  Note  that,  the  missile  system  types  are  generic,  and  the 
typical  subsystems  are  generalized  examples.  A  very  brief  discussion  by 
subsystem  follows. 

6. 4. 1.1  Propulsion  Subsystem. 

The  propulsion  subsystem  of  missiles  can  be  either  a  solid  or  liquid 
fuel  system.  If  the  subsystem  Is  a  solid  rocket  motor,  accelerated 
environmental  testing  can  be  accomplished  at  the  contractor's  facility. 
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SCREENING  TESTS  (See  Annex  E) 

Acceptance  Tests 
Accelerated  Tests 

Power  On/Power  Off 

Test  Equipment/BIT  On/Off 
Environmental 
Stress 

Test  Equipment/BIT  Continuous 
Transportation  and  Handling  (Increased  Frequency) 
Launcher  Carriage  (Increased  Frequency) 
Mobility  Tests 
REAL  TIME  TESTS 

Surveillance  Tests 

Missile  System  (Storage)  Surveillance 
Subsystem  (Storage)  Surveillance 
Shelf  Life  Surveillance 

Transportation  and  Handling  (Procedure  Oriented) 
Mobility  Exercises 
Captive  Carry 
Live  Firing 

aOM*41-01»-TK 


Figure  10.  Overview  of  Dormant  Reliability  Related  Tests 
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The  Naval  Ordnance  Station  can  also  be  used  if  the  facility  is  large 
enough  to  accommodate  the  motor.  The  length  of  time  for  the  accelerated 
testing  will  depend  on  the  time  necessary  to  simulate  the  proposed  storage 
environment.  Surveillance  testing  can  also  be  used  to  test  for  dormant 
reliability.  However,  the  time  to  accomplish  the  real-time  surveillance 
may  be  quite  long,  depending  on  the  sample  size  available.  Shelf  life 
surveillance  by  another  agency  may  be  appropriate  in  this  case. 

Liquid  fuel  propulsion  systems  can  also  be  tested  through  acceler¬ 
ated  environmental  testing  if  the  failure  mode  of  the  fuel  itself  does 
not  change.  Given  early  AFTEC  involvement,  surveillance  testing  may  be  a 
better  method  than  accelerated  environmental  testing. 

6.4. 1.2  Control  Subsystem. 

The  control  subsystem  of  missiles  is  composed  of  both  elect* j- 
mechanical  and  hydraulic  (or  pneumatic)  components.  The  movement  of  the 
control  surfaces  is  accomplished  hydraulically  by  electrical  impulses 
activating  the  hydraulic  motor.  Some  missiles  may  use  only  electro¬ 
mechanical  components  to  activate  a  control  surface.  The  electrical 
impulse  from  the  guidance  unit  will  activate  an  electrical  motor  to  move 
the  control  surfaces. 

The  electromechanical  systems  can  use  power  on/off  and  environmental 
cycling  in  an  accelerated  manner  for  testing.  The  testing  of  hydraulic 
systems  is  more  amenable  to  surveillance  and  accelerated  environment 
testing,  as  operation  of  the  system  during  testing  may  change  the  failure 
mode.  Surveillance  testing  applies  In  either  case. 

6.4. 1.3  Navlqation/Guidance  Considerations. 

Systems  with  inertial  navigation/guidance  are  generally  more  subject 
to  mechanical  and  hydraulic  degradation  during  storage  than  are  termi¬ 
nally  guided  (electro-optical)  systems.  Long  term  surveillance  testing 
may  be  more  appropriate  for  Inertially  guided  systems,  whereas  accelerated 
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testing  may  be  more  appropriate  for  terminally  guided  systems.  In  some 
cases,  terminally  guided  systems  may  simply  be  mechanically  guided, 
requiring  the  alignment  of  the  launch  platform  (aircraft)  and  free  flight 
to  target.  In  that  case,  little  or  nj  testing  would  be  required. 

6.4. 1.4  Airframe  Considerations. 

The  assessment  of  the  dormant  reliability  of  different  airframes 
should  consider  the  composition  of  materials  and  the  complexity  of  as¬ 
sembly.  If  the  exterior  coating  of  the  missile  is  critical  to  surviv¬ 
ability  issues  (radar  signatures),  accelerated  environmental  testing 
should  be  considered  to  determine  corrosion  or  flaking  impacts.  Surveil¬ 
lance  testing  is  appropriate  in  all  cases. 

6.4.2  OT&E  Testing  Perspective. 

In  dormant  missile  systems,  it  is  critically  important  that  AFTEC 
pursue  early  involvement  and  collaboration  in  the  development/acquisition 
process  since  operational  testing  for  dormant  reliability  is  inherently 
limited.  ALL  of  the  weapon  system  developer's  activities  as  discussed  in 
sections  II  and  V  should  be  closely  monitored,  particularly  those  which 
will  ultimately  be  used  for  dormant  reliability  estimating  purposes.  In 
addition,  particular  attention  should  be  given  to  surveillance  tests 
(structured  via  early  involvement),  service  reporting/ECPs,  engineering 
"fixes,"  and  development  of  operational  and  maintenance  concepts. 

With  this  as  background,  the  real  issue  becomes:  which  tests  are 
appropriate  and  necessary  for  AFTEC  to  conduct  during  OT&E.  The  process 
involved  in  this  decision  is  based  on  a  straightforward  and  logical 
progression.  First,  early  detailed  knowledge  of  the  system  itself  is 
necessary.  Second,  a  review  of  the  maintenance  and  operations  concepts 
should  be  performed.  If  these  concepts  are  not  available,  early  col¬ 
laboration  with  the  development/user  community  will  help  in  providing  at 
least  provisional  concepts.  From  these  concepts,  a  life  cycle  profile 
should  be  constructed,  keying  on  the  definitions  provided  in  section  III, 
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Based  on  the  life  cycle  profile,  decisions  can  be  made  regarding  the 
states  of  dormancy  which  are  sensitive  to  OT&E  and  appropriate  tests  by 
system/subsystem.  In  addition,  close  monitoring  of  ECPs  and  engineering 
"fixes"  should  provide  an  input  into  the  decision  making  process.  If 
these  £CPs/"fixes"  are  significant  and  are  test  sensitive,  then  they 
should  be  included  where  appropriate  as  updates  (realizing  that  their 
status  is  constantly  changing).  A  schematic  of  the  decision  making 
process  is  provided  in  figure  11. 

6.4.3  Test  Sensitive  Elements. 

The  OT&E  test  sensitive  decision  process  was  applied  to  a  typical 
example  in  order  to  verify  the  logic  involved  and  to  examine  the  test 
sensitive  elements  which  were  thus  produced.  The  concept  of  operations 
was  that  of  a  typical  tactical  air-to-air  missile.  The  maintenance 
concept  was  periodic  test  and  repair.  The  life  cycle  profile  used  is 
contained  in  annex  C.  A  summary  of  test  sensitive  elements  is  provided 
in  figure  12.  Specific  test  sensitive  considerations  follow. 

6. 4. 3.1  Initial  Undetected  Failures. 

If  OT&E  is  to  represent  the  actual  field  environment,  then  test 
articles  (missiles)  should  be  acceptance  tested  by  the  contractor  and 
shipped  to  the  field  (OT&E  test  location)  as  would  be  the  case  in  actual 
practice.  The  undetected  failures  (a.j)  present  after  acceptance  testing 
and  shipping  is  partially  test  sensitive.  If  complete  checkout  were 
accomplished  when  missiles  were  received  (predeployment  checkout),  some 
of  these  previously  undetected  failures  could  be  found  (allowing  for  some 
type  1  error  in  the  OT&E  test  equipment).  These  failures  would  represent 
a  portion  (which  could  be  statistically  sized)  of  the  combination  of 
and  shipping  induced  failures.  Transportation  and  handling  failures  can 
be  tested  separately,  then  factored  to  estimate  a^.  Special  consideration 
of  the  test  equipment  itself  in  conjunction  with  a  PMEL  is  warranted. 


77 


Figure  11.  OTSE_  Test  Sensitive  Decision  Process 
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Figure  12.  Sunwary  of  OT&E  Test  Sensitive  Elements 
(Tactical  Alr-to-AIr  Missile) 
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6. 4. 3. 2  Transportation  and  Handling. 

Transportation  and  handling  is  test  sensitive  and  can  be  measured  by 
both  accelerated  and  real-time  means.  Actual  loading/unloading  opera¬ 
tions  and  transportation  to  and  from  the  flight  line  can  be  repeated 
until  failures  occur.  Deployment/mobility  exercises  can  be  conducted  in 
real  time.  Care  must  be  taken  to  account  for  time  spent  in  the  dormancy 
state  and  identified  failures. 

6. 4. 3. 3.  Periodic  Test  and  Maintenance  Induced  Failures. 

Failures  induced  by  test  equipment,  maintenance,  and  the  power 

on/off  cycling  activities  effects  are  test  sensitive  and  can  be  measured 
in  several  ways.  Correlation  among  these  results  can  assist  in  isolating 
the  cause  of  the  appropriate  failures.  Specific  tests  are: 

a)  System  level  power  on/off. 

b)  On-equipment  test  sequence/BIT,  continuous  operation 

(attached  to  missile)  until  failure. 

c)  On-equipment  test  sequence/BIT,  on/off. 

d)  Subsystem  test  station/BIT  (Shop)  test  sequence,  on/off. 

e)  Subsystem  test  station/BIT  (Shop)  test  sequence,  contin¬ 
uous  until  failure. 

f)  Flight  line  "tone"  checks,  on/off. 

In  addition,  tracking  normal  maintenance  reporting  by  when  discovered/how 
malfunctioned  codes  can  assist  in  isolating  maintenance  induced  failures 
during  the  latter  stages  of  I0T&E  and  FQT&E. 

6. 4. 3. 4  Test  Equipment  Efficiency.  ' 

Test  equipment  efficiency  (type  1  error)  can  be  "evaluated"  in 
conjunction  with  PMEL  and  maintenance  specialists.  It  can  be  tested  by 
injection  of  known  faults.  The  evaluation,  abbve,  In  conjunction  with  a 
FMEA  should  give  clues  as  to  which  faults  to  Inject  and  which  faults  are 
likely  to  go  undetected. 
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6. 4. 3. 5  Captive  Carry. 

Failures  induced  .  captive  carry  (for  those  subsystems  which  are 
non-operating)  are  test  sensitive  if  failures  are  tracked  and  time  is 
properly  accounted  for.  Testing  for  non-operating  failures  in  this 
dormancy  mode  requires  pre-  and  postflight  checkout  (more  data  for  "tone1' 
check  test)  of  the  missile. 

6. 4. 3. 6  Surveillance  Testing. 

Surveillance  testing  is  partially  test  sensitive.  If  the  test 
program  is  long  enough,  a  sample  lot  of  missiles  could  be  "checked  out" 
after  residing  in  storage  for  the  entire  test  period.  With  very  good 
advanced  planning  (and  a  little  luck)  some  missiles  might  be  pre¬ 
positioned  in  storage,  on  location,  prior  to  the  start  of  OT&E,  in  order 
to  increase  accrued  storage  time.  This  applies  to  FOT&E  in  particular. 
Another  surveillance  sampling  technique  that  could  be  employed  during 
FOT&E  is  to  take  a  "snapshot"  sample  from  various  deployed,  operational 
missile  locations.  In  this  case  a  traveling  team,  possibly  augmented  by 
onsite  personnel,  would  completely  "check  out"  a  sample  of  missiles  that 
had  been  in  storage  in  the  actual  field  environment.  If  the  sample  is 
large  enough,  a  fairly  accurate  projection  could  be  made.  This  would 
also  eliminate  error  induced  by  shipping  selected  missiles  back ,  to  a 
central  location  for  surveillance  test  sampling.  Care  should  be  exerr 
cised  in  this  regard  if  the  maintenance  concept  involves  a  wooden  round 
since  failures  could  be  Induced  by  the  test  and  checkout  procedure. 

6.4.3.?  Test  Firing. 

Firing  rocket  motors  and  warheads  is  test  sensitive  (with  regard  to 
dormancy)  to  a  large  degree.  The  nature  of  these  subsystems  is  that  they 
are  dormant  until  fired.  Every  live  firing  failure  of  these  subsystems 
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could  be  attributed  to  at  least  a  multimode  dormant  condition.  In  addi¬ 
tion,  if  rocket  motors  and  warheads  are  "off  the  shelf,"  as  is  often  the 
case,  then  test  firing  "old"  items  could  be  used  to  assess  dormant  reli¬ 
ability. 

6.5  EVALUATING  DORMANCY  EFFECTS. 

The  estimating  techniques  of  table  1  and  the  test  methodologies  of 
figure  12  are  both  (in  their  own  right)  sufficient  to  "measure"  all 
states  of  dormant  reliability  (inherent  dormant  reliability,  operation¬ 
ally  ready  storage,  non-operating  transportation  and  handling,  non-operat¬ 
ing  launcher  carriage  when  applicable,  and  non-operating  captive  carry). 
The  summation  of  all  failure  rates  (by  subsystem)  weighted  by  the  time 
spent  in  each  dormant  mode  results  in  an  overall  dormant  reliability 
value.  This  value  in  turn  can  be  used  to  predict  dormancy  effects  (see 
paragraph  3.4).  Logistics  effects  such  as  manpower,  spares,  support 
equipment,  etc.,  can  be  assessed  by  typical  LSET  methods.  Operational 
reliability  effects  (due  to  dormancy)  can  be  assessed  in  a  two-step 
process.  First,  the  critical  failures  must  be  identified  and  factored 
out  of  the  overall  dormant  reliability  (typical  LSET,  criticality  analy¬ 
sis  and  MCSP,  etc.,  methods  apply)  value.  Then  the  resultant  mission 
critical  failures  can  be  used  in  a  flight  success  model  or  (probability 
of  kill)  probability  chain. 

Dormancy  effects  can  also  be  generated  by  using  the  failure  rates  by 
state  as  previously  defined  in  a  simulation  model  (such  as  the  ALCM 
availability  model)  or  the  life  cycle  profile  could  be  "exercised"  by 
proper  selection  of  time  In  each  state  and  probabilities  for  entries  Into 
each  state.  In  each  case,  typical  methods  familiar  to  AFTEC  apply. 

6.6  EVALUATING  THE  WOODEN  ROUNO. 

An  example  of  this  process  Is  contained  in  annex  C.  This  particular 
example  was  developed  by  the  Martin  Marietta  Corporation  and  is  a  very 
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good  representation  of  the  typical  approach.  In  this  example,  the  dormant 
failure  rates  are  held  constant  for  both  the  wooden  round  and  the  periodic 
test  concept  so  that  a  comparison  can  be  made- -a  valid  approach. 

Given  only  these  conditions,  the  periodic  test  concept  will  always 
predominate  in  terms  of  a  trade-off  against  a  wooden  round.  The  example 
breaks  down  at  this  point,  however,  in  that  no  consideration  was  given  to 
failures  induced  by  test  equipment  and  maintenance  actions.  With  these 
factors  included,  the  "saw  tooth"  curve  (see  figure  13)  will  shift  down¬ 
ward.  In  addition,  reliability  growth  will  shift  both  curves  upward. 

Thus,  evaluation  of  the  wooden  round  boils  down  to  a  very  close 
examination  of  induced  failures  and  reliability  growth. 

The  reliability  achieved  by  the  periodic  test  concept  lowered  by 
induced  failures  and  the  associated  costs  (maintenance,  spare  parts, 
support  equipment,  and  facilities,  etc.)  can  be  compared  to  the  reli¬ 
ability  achieved  by  the  wooden  round  and  its  associated  costs  (spare 
missiles  necessary  to  meet  the  required  operational  capability).  The 
estimating  and  testing  techniques  for  induced  failures  previously  pre¬ 
sented  become  critical  in  this  evaluation. 

Additional  consideration  should  be  given  to  reliability  growth  pro¬ 
jections  (a  very  careful  evaluation  is  necessary)  in  comparison  to  re¬ 
quired  operational  capability  and  the  spare  missiles  necessary  to  meet 
and  maintain  it,  both  before  and  after  "growth". 
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Figure  13.  Example  Missile  Reliability  after  5  Years  of  Dormant 
Deployment  Under  "Wooden  Round"  and  Periodic  Test 
Concept  (Does  Hot  Include  Type  2  and  6  Failures} 
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SECTION  VII 
DATA  SOURCES 

7.1  OVERVIEW. 

During  any  new  missile  systems's  dormant  reliability  evaluation, 
obtaining  current  dormant  reliability  data  on  comparable  systems  or  sub¬ 
systems  is  judicious,  and,  of  course,  requisite,  if  a  ^arability  anal¬ 
ysis  is  to  be  performed.  However,  there  are  no  ma,  ;  .  DoD  standard, 
automated  data  systems  specifically  designed  to  accumulate  or  output 
dormant  reliability  data.  For  the  most  part,  data  pertaining  to  dormant 
reliability  characteristics  of  missile  systems  are  fragmented  and  spread 
throughout  a  myriad  of  documents,  contractors,  individual  missile  program 
management  organizations,  and  lower  level  DoD  organizations.  There  may 
be  a  limited  usefulness  for  obtaining  failure  data  for  missiles  from  the 
Air  Force  Base  Level  Maintenance  Data  Collection  System  (MDC5) ,  but  a 
thorough  understanding  of  the  system  code  conventions  is  required  as  well 
as  a  structured  analytical  approach  to  the  data  manipulation  and  defin¬ 
ition.  It  is  usually  easier  for  the  reliability  analyst  to  directly  con¬ 
tact  a  comparable  missile  system's  program  office  cr  responsible  Air 
Logistic  Center  for  data  or  other  points  of  contact.  This  section  defines 
some  of  the  major  documents,  points  of  contact,  or  data  systems  that  can 
be  used  as  a  starting  point  in  a  data  acquisition  effort.  The  reader  is 
also  referred  to  the  fairly  extensive  reference  list  in  annex  Ft 

7.2  AIR  FORCE  OATA. 

Missile  management  within  the  Air  Force  (and  Navy,  in  most  cases)  Is 
somewhat  fragmented.  Air  Logistics  Centers  (ALCs)  are  assigned  item 
management  for  component/subsystems  (e  g. ,  Odgen  ALC  for  explosive/ 
pyrotechnic  services,  Warner-Robins  ALC  for  guidance  systems,  etc.)  If  a 
life  surveillance  test  program  for  a  missile  system  is  initiated  and 
maintained,  it  is  usually  supported  through  separate  ALCs,  each  with 
somewhat  unique  data  collection  and  reporting  systems. 
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For  example,  the  Maverick  missile  program  has  a  long  term  storage 
surveillance  and  periodic  inspection  proqram  being  maintained  by  the  ALC 
at  Hill  AFB,  Utah.  The  primary  data  collected  concerns  the  effects  of 
storage  on  the  three  major  subsystems  of  the  missile:  propellant,  guid¬ 
ance,  and  hydraulic  actuation  system.  The  ALC  is  supported  by  engineers 
who  direct  the  reliability,  surveillance  and  inspection  program,  and  a 
contractor  (Ultrasystems,  Inc. )  who  performs  data  collection,  analysis,, 
and  reporting  tasks  for  the  system  manager.  Ultrasystems  also  performs 
the  data  collection,  analysis  and  reporting  tasks  for  the  fleet  aging 
surveillance  Drogram  for  the  Minuteman  II  missile.  Ogden  ALC  also  main¬ 
tains  an  extensive  data  bank  on  a  number  of  pyrotechnic  surveillance 
programs. 

A  surveillance  testing  model  designed  for  use  in  the  AMRAAM  program 
is  available  from  AFLC/AFALO.  The  model  may  be  used  to  analyze  the 
inventory  availability,  surveillance  testing  workload,  and  repair  work¬ 
load  of  other  systems  subject  to  long  term  storage  and  periodic  inspec¬ 
tion. 

Initial  storage/surveillance  testing  for  the  ALCM  system  is  being 
performed  by  AFSC/ASD/YEE.  Under  this  program  two  complete  ALCM  air¬ 
frames  art  undergoing  an  operational  environment  test  (OET),  and  two  ALCM 
engines  mounted  in  aft  missile  sections  art  being  rotated  through  90  days 
of  storage  and  90  days  of  outside  environment  conditions. 

7.3  ARMY  DATA. 

A  large  majority  of  the  Army  missile  reliability  data  Is  stored  at 
the  Redstone  Arsenal  in  Huntsville,  Alabama.  However,  it  is  generally 
recommended  that  individual  missile  program  managers  be  contacted  for 
specific  data.  Additional  data  sources  may  be  found  at  the  U.S.  Army 
Research  and  Development  Command,  Dover,  NJ,  or  the  U.S.  Army  Readiness 
Command,  Rock  Island,  IL.  One  of  the  more  definitive  studies  on  missile 
dormant  re',  lability  was  accomplished  with  the  Raytheon  Company  study  on 
the  "Storage  Reliability  of  Missile  Materiel  Program"  for  MIRAOCOM  Ini¬ 
tiated  in  1974.  Thm  original  series  of  publications  were  produced  in 
1976  ard  updated  in  1978. 
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The  Lance  missile  reliability  data  is  being  managed  through  the 
MIRADCCM/LANCE  PMO,  at  Redstone  Arsenal.  In  this  program,  deployed 
missiles  are  tracked  through  a  special  data  collection  system  that  helps 
to  validate  design  criteria  using  piece  part  data  and  working  up  to  the 
system  level. 

One  of  the  most  important  focal  points  for  dormant  reliability  data 
is  the  MIPADCOM/Product  Assurance  Division  at  Redstone  Arsenal.  This 
division  currently  maintains  the  Non-Operating  Reliability  Data  Bank  for 
missile  systems  (at  this  time  the  only  known  automated  data  bank  built 
specifically  to  manipulate  only  non-operational  reliability  data). 
Although  the  data  bank  is  currently  based  upon  a  piece  part  level  of  data 
storage  and  reporting,  efforts  are  currently  underway  to  improve  the 
files  for  data  extraction  to  include  the  capability  of  collating  piece 
part  data  to  develop  a  system  storage  reliability  data  base. 

7.4  NAVY  DATA. 

The  Navy  Maintenance  Data  System  is  the  most  complex  and  detailed  of 
the  three  Services.  uuwever,  the  data  collected  under  the  formal  record¬ 
ing  procedures  (similar  to  the  Air  Force  MOC  system)  does  not  contain 
specific  dormant  reliability  data.  Again,  particular  reliability  infor¬ 
mation  about  a  specific  missile  or  missile  subsystem  should  most  likely 
be  sought  fro*  Navy  system  program  offices  or  from  specific  test  sites  or 
organizations. 

For  Instance,  the  Naval  Ordnance  Station  at  Indian  Head,  Maryland 
has  facilities  for  accelerated  environmental  testing  of  solid  rocket 
motors.  Accelerated  testing  is  accomplished  at  twice  the  normal  environ¬ 
mental  temperature  cycles,  and  data  has  been  gathered  for  several  motor 
types. 

The  Naval  Weapons  Center  at  China  Lake,  California  is  one  of  the 
major  development  and  test  facilities  for  Navy  missiles.  In  particular, 
much  data  has  been  gathered  on  anti-radiation  and  air-to-air  missiles  at 
this  site.  For  cruise  missile  comparability  data,  the  Navy  Fleet 
Analysis  Center  at  Corona,  California  Is  currently  collecting  Harpoon 
data  and  has  recently  developed  storage  reliability  data. 
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7.5  DATA  SYSTEMS  LIMITATIONS. 

It  is  readily  apparent  from  this  discussion  that  data  pertaining  to 
dormant  missile  reliability  are  very  limited.  What  data  exist  are  frag¬ 
mented  in  various  locations,  generally  on  a  program  basis.  The  Services' 
maintenance  data  collection  systems  are  not  structured  in  a  way  that 
allows  dormancy  information  to  be  captured  and  reported.  It  is  fairly 
obvious  that  data  sources  will  present  one  of  the  greatest  J! ff iculties 
in  any  assessment  of  dormant  reliability. 

With  the  current  trends  in  missiles,  dormant  reliability,  «>nd  the 
acquisition  process  which  supports  these  trends,  the  challenge  then 
becomes  one  of  effecting  coordination  among  agencias  to  agnize  the 
usefulness  of  existing  da*.a/data  systems  and  to  imorove  end  potentially 
standardize  the  process  over  time  toward  the  same  end. 
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SECTION  VIII 

DORMANT  RELIABILITY  ASSESSMENT  APPROACH 


8.1  OVERVIEW. 

The  general  approach  to  assessing  dormant  reliability  is  to  build 
upon  the  results  of  all  previous  chapters  in  an  iterative  process  —  one 
which  is  in  consonance  with  the  development  process  milestones  and  activ¬ 
ities  (see  figure  5).  The  central  methodology  issues  of  estimating  and 
testing  dormant  reliability  are  provided  in  section  VI,  particularly 
table  1  and  figures  11  and  12.  These  methodologies  in  combination  with 
the  (no  less  Critical)  necessary  planning,  monitoring,  and  coordination 
activities  essentially  frame  the  analytical  approach. 

Figure  14  provides  an  overview  of  the  assessment  approach.  Each 
activity  block  in  the  figure  is  keyed  to  the  portions  of  the  report  which 
describe  and  develop  the  necessary  prerequisites.  The  process  "loops1'  in 
a  way  which  covers  the  missile  system's  entire  life  cycle.  The  products 
of  continuing  planning  and  milestone  reviews  as  well  as  results  of  the 
comprehensive  test  and  evaluation  program  are  fed  back  to  permit  contin¬ 
uous  iteration  and  update.  It  is  a  process  which  logically  tracks 
reality. 

8.2  IMPLEMENTATION  GUIDELINES. 

The  approach  for  assessing  missile  system  dormant  reliability  as 
part  of  a  comprehensive  test  and  evaluation  program  is  depicted  in  figure 
14.  Preceding  sections  have  provided  detailed  background  discussions 
within  the  major  topic  areas  necessary  to  formulate  the  approach.  This 
set  of  general  guidelines  is  provided  for  use  in  employing  the  approach. 
It  Is  not  intended  as  a  "cookbook"  approach  nor  is  it  meant  to  represent 
a  detailed  checklist.  In  fact,  It  should  be  regarded  as  a  series  of 
initial  points  from  which  the  analyst  can  depart  to  accomplish  neceosary 
tasks  in  the  dormant  reliability  assessment  program. 
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8.2.1  Planning. 

The  guidelines  for  the  planning  phase  have  been  divided  to  reflect 
the  early  or  advanced  planning  and  the  detailed  planning  associated  with 
preparation  fbr  conduct  of  the  IOT&E. 

8.2. 1.1  Advanced  Planning. 

a)  Review  program  documentation  from  the  SPQ  and  contractor 
for  critical  questions  and  areas  of  risk  associated  with 
dormant  reliability. 

b)  Review  operations  and  maintenance  concepts  for  background 
in  dormant  reliability  testing. 

c)  Ensure  that  the  failure  definitions  to  be  applicable 

throughout  testing  are  incorporated  in  appropriate  program 
documentation,  e.g. ,  PMO,  TEMP,  TPO,  Contract,  etc. 

d)  Formulate  the  life  cycle  profile  model. 

e)  Ensure  that  a  piece  part  dormant  reliability  prediction  is 
accomplished  by  the  SPO  or  contractor.  Review  the  pre¬ 
diction  if  one  is  already  accomplished. 

f)  Review  system  design  for  dormant  reliability  consider¬ 
ations. 

g)  From  initial  reliability  predictions,  determine  prelim¬ 
inary  number  of  assets  for  system  surveillance  tests 

during  IOT&E  and  recommend  that  the  assets  be  incorporated 
into  the  contract  and  SPO  budget. 

h)  Review  the  contract  to  determine  if  failure  analyses  are 
required.  If  failure  analyses  are  not  included,  recommend 
contract  amendment  to  include  analyses. 

1)  Review  the  contract  and  DT&E  test  plan  for  contractor 

accelerated  testing  of  piece  parts  and  subsystems.  If 
accelerated  testing  is  not  included,  recommend  contract 
addition. 
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j)  Ensure  test  objectives  in  the  IOT&E  test  plan  include 
accelerated  and  surveillance  testing. 

k)  Ensure  coordination  of  MOEs  for  the  accelerated  and  sur¬ 
veillance  tests. 

8.2. 1.2  Detailed  Test  Planning. 

a)  Review  the  current  design  and  the  current  operations  and 
maintenance  concepts  to  update  the  life  cycle  profile, 
IOT&E  objectives,  and  test  methodology. 

b)  Review  failure  analyses. 

c)  If  the  system  incorporates  solid  rocket  motors,  check  with 
Navy  Ordnance  Station  for  information  on  testing. 

d)  Update  the  reliability  prediction  due  to  design  or  opera¬ 
tion  8nd  maintenance  concept  changes. 

e)  Review  the  Failure  Modes,  Effects,  and  Criticality  Anal¬ 
ysis  (FMECA)  for  updating  IOT&E  test  plan  objectives  and 
methodology. 

f)  Ensure  initiation  of  subsystem  and  component  accelerated 
testing. 

g)  Ensure  initiation  of  surveillance  tests  of  subsystems  and 
components. 

h)  Accomplish  detailed  test  planning  methodology  for  appro¬ 
priate  system  tests  to  address  sensitive  areas. 

i)  Ensure  that  assets  are  identified  for  above  tests. 

8.2.2  IOT&E. 

a)  Review  current  design  and  current  operations  and  mainte¬ 
nance  concepts. 

b)  Update  the  life  cycle  profile,  as  necessary. 

c)  Review  failure  analyses. 


THE  BDM  CORPORATION 


d)  Update  dormant  reliability  prediction  for  changes  in 
system  design  and/or  operations  and  maintenance  concept 
changes. 

e)  Start  system  surveillance  tests  with  sample  partitioned  to 
examine  previously  determined  sensitive  test  areas. 

f)  Compare  DT&E  and  early  component  and  subsystem  IOT&E 
accelerated  and  surveillance  test  data  to  preliminary 
IOT&E  data. 

g)  Calculate  the  failure  rates  and  compare  to  T/S/G  and 
predicted  reliability. 

h)  Document  deficiencies  and  review  engineering  fixes  of  the 
deficiencies. 

i)  Compare  test  data  for  failure  rates  to  scheduled  inspect 
tion  period. 

j)  Review  and  analyze  test  equipment  efficiency. 

8.2.3  FOT&E. 

a)  Refine  lifecycle  profile,  as  necessary. 

b)  Oevelop  FOT&E  objectives  if  different  from  IOT&E  objec¬ 
tives. 

c)  Establish  new  MOEs  if  necessary. 

d)  Continue  surveillance  tests. 

e)  Update  failure  rate  and  compare  to  predicted  failure  rate. 

f)  Update  test  calculated  failure  rate  and  compare  to  pre¬ 
dicted  failure  rate. 

g)  Statistically  analyze  and  compare  IOT&E  and  production 
failure  rates  for  statistical  differences. 

h)  Statistically  analyze  OT&E  (accelerated  and  surveillance 
tests)  and  production  failure  rates  for  statistical  dif¬ 
ferences. 
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SECTION  IX 

CONCLUSIONS  AND  RECOMMENDATIONS 

9.1  CONCLUSIONS. 

The  following  conclusions  are  offered  as  a  result  of  this  study 
effort. 

a)  The  notion  of  dormancy  is  non-trivial,  and  well -structured 
definitions  of  dormant-related  terminology,  within  the 
context  of  the  specific  missile  system  being  developed, 
are  essential  to  properly  estimate  and  test  for  dormant 
system  reliability. 

b)  Reliability  prediction  through  both  analytical  estimation 
and  test  techniques  is  possible.  Although  some  areas  have 
not  been  validated,  they  look  promising.  Both  types  of 
techniques  cover  the  total  spectrum  of  dormant  reliability 
assessment.  Therefore,  begin  by  updating  initial  contrac¬ 
tor  estimates  and  transition  to  testing  when  practical. 

c)  Early  formulation  of  the  missile  system's  life  cycle 
profile  model  is  essential  to  the  entire  process  of  defin¬ 
ing  dormancy,  structuring  a  comprehensive  test  program, 
and  assessing  the  effects  of  dormancy  on  operational 
reliability  and  logistics  reliability. 

d)  A  disciplined  approach  has  been  provided  which  can  be  used 
as  the  framework  for  developing  a  structured  test  method¬ 
ology  for  a  specific  missile  system's  dormant  reliability 
assessment  program. 

e)  Reliability  prediction  based  upon  the  piece  part  count 
methodology  should  not  be  ignored.  During  the  early 
planning  phase,  it  may  provide  the  only  source  of  avail¬ 
able  data. 

f)  Early  AFTEC  involvement  during  the  conceptual  phase  of  the 
missile  system  acquisition  cycle  is  essential. 
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g)  The  critical  element  of  "dormant  failure  rate"  for  missile 
systems  maintained  under  a  wooden  round  concept  appears  to 
be  induced  failures.  System  reliability  can  be  improved 
with  a  periodic  test  concept  provided  the  induced  failure 
rate  can  be  held  to  a  low  level. 

9.2  RECOMMENDATIONS. 

During  the  course  of  this  study,  it  has  become  increasingly  apparent 
that  only  the  surface  of  dormant  reliability  has  been  scratched.  Each 
new  report,  journal  article,  etc.,  provides  a  bibliography  or  reference 
list  sufficient  to  warrant  pursuit  of  the  subject  for  several  more  days 
or  weeks.  Five  specific  areas  are  worthy  of  further  investigation. 

a)  Validation  of  the  proposed  methodology  should  be  accom¬ 
plished  as  soon  as  possible.  It  is  anticipated  that  such 
a  task  probably  cannot  be  accomplished  in  the  *n*  ial 
attempt.  The  approach  relies  heavily  upon  outside  (of 
AFTEC)  interfaces  to  provide  input;  it  will  take  time  to 
develop  such  interfaces. 

b)  There  is  an  urgent  need  to  conduct  a  comprehensive  survey 
of  relevant  data  bases  (e.g.,  USAF  MDC,  Army,  Navy,  con¬ 
tractor,  etc.)  and  characterize  their  similarities  and 
dissimilarities.  It  is  strongly  suspected  that  the  manner 
in  which  failure  data  are  collected  and  maintained  pre¬ 
cludes  any  meaningful  assessment  of  dormant  reliability. 

c)  A  comprehensive  missile  system/subsystem  comparability 
survey  is  necessary.  The  product  of  such  an  effort  would 
provide  valuable  input  for  defining  and  establishing 
structured  data  bases  compatible  with  reliability  pre¬ 
diction  requirements.  It  would  also  provide  a  convenient 
and  valuable  source  of  similarity  data  at  the  missile 
system/subsystem  level  for  use  in  early  comparability 
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analyses  and  selection  of  appropriate  sources  for  similar 
system/subsystem  data. 

d)  The  area  of  accelerated  system  testing  warrants  further 
study.  There  is  insufficient  data  at  this  time  to  enable 
any  conclusion  to  be  drawn,  with  reasonable  confidence, 
about  the  utility  of  such  testing.  It  appears  to  be 
feasible  in  some  areas  (e.g.,  environmental  cycling)  but 
not  in  others  (e.g.,  power  on/off  cycling),  except  in 
limited  specific  cases. 

e)  "Community"  consistency  regarding  the  definition  of  dor¬ 
mancy  (and  thus  the  application  of  various  techniques  and 
methodologies)  is  necessary.  It  is  possible  that  the 
"community"  could  benefit  from  an  AFTEC- sponsored  confer¬ 
ence  similar  to  the  Air  Force-wide  Cost  of  Ownership  defi¬ 
nition  process  sponsored  by  AFTEC  in  1975.  Ambiguity 
could  be  reduced,  cross  utilization  could  be  enhanced,  and 
common  data  base  structures  established. 
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ANNEX  A 

FAILURE  RATE  CALCULATION  PROCEDURES 


A.  1  INTRODUCTION. 

Parts  count  and  part  stress  analysis  prediction  methodologies  were 
briefly  discussed  in  section  IV.  They  were  presented  as  applicable 
reliability  prediction  techniques  for  use  during  the  design  and  early 
development  phases  in  the  weapon  system  acquisition  process.  The  tech¬ 
niques  are  widely  accepted  and  periodically  reviewed  and  refined,  as 
necessary,  as  part  of  the  Rome  Air  Development  Center  Reliability  Pro¬ 
gram.  This  annex  represents  a  compilation  of  information  from  references 
34,  36,  and  37.  It  is  intended  to  provide  a  sufficiently  relevant  dis¬ 
cussion  to  familiarize  the  AFTEC  analyst  with  the  methodology,  not  to 
provide  detailed  instructions  on  the  use  of  the  techniques. 

A.  2  PART  FAILURE  MODELING. 

Prediction  is  an  integral  task  of  reliability  development  programs. 
The  basic  concept  which  underlies  reliability  prediction  and  the  calcu¬ 
lation  of  reliability  numerics  is  that  system  failure  is  a  reflection  of 
part  failure.  Therefore,  a  method  for  estimating  part  failure  rates  is 
needed.  The  most  direct  approach  involves  the  use  of  large  scale  data 
collection  efforts  to  determine  the  relationships  (i.e. ,  models)  between 
engineering  and  reliability  variables.  This  approach  utilizes  controlled 
test  data  to:  ~ 

a)  Derive  relationships  between  design  and  generic  reliabil¬ 
ity  factors,  and 

b)  Develop  factors  for  adjusting  the  reliability  to  estimate 
field  reliability  when  considering  application  conditions. 

These  data  were  reduced  through  physics-of-failure  techniques  and 
included  in  MIL-HDBK-2178  in  a  form  suitable  for  estimating  stress- related 
failure  rates.  MIL-HDBK-217B  provides  guidance  during  design  and  allows 
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individual  part  failure  rates  to  be  combined  within  a  suitable  system 
reliability  model  to  arrive  at  an  estimate  of  system  reliability. 

Part  failure  models  vary  with  different  part  types.  However,  their 
general  form  is: 

Xpar-t=  (\)(V(nA)(V  ••\(7ln) 
where: 

\  t  1S  total  part  failure  rate. 

is  the  base  failure  rate.  The  value  is  obtained  from  reduced  part 
test  data  for  each  generic  part  category,  where  the  data  is  gener¬ 
ally  presented  in  the  form  of  failure  rate  versus  normalized  stress 
and  temperature  factors.  The  part's  primary  load  stress  factor  and 
its  factpr  or  safety  are  reflected  in  this  basic  failure  rate  value. 
The  value  of  \b  is  generally  determined , by  the  anticipated  stress 
level  (e.g. ,  power  and  voltage)  at  the  expected  operating  temper¬ 
ature.  These  values  of  applied  stress  (relative  to  the  part's  rated 
stress)  represent  the  variables  over  which  design  control  can  be 
exercised  and  which  influence  the  item's  ultimate  reliability. 

is  the  environmental  adjustment  factor  which  accounts  for  the  influ¬ 
ences  of  environments  other  than  temperature,  and  is  related  to  the 
military  operating  condition  (e.g.,  vibration,  humidity,  etc.)  under 
which  the  item  must  perform.  Twenty- three  of  these  environmental 
classes  have  been  defined  in  MIL-HDBK-217B.  Depending  upon  the 
specific  part  type  and  style,  the  value  of  rtg  will  vary  from  1.0, 
the  ground  benign  environment,  up  to  more  than  700.  The  missile 
launch  environment  is  one  of  the  most  severe  and  generally  dictates 
a  high  value  of 

is  the  application  adjustment  factor.  This  factor  depends  on  the 
application  of  the  part,  and  takes  into  account  secondary  stress  and 
application  factors  that  are  considered  to  be  "reliability-signif¬ 
icant." 


A-2 


THE  BDM  CORPORATION 


rig  is  the  quality  adjustment  factor  used  to  account  for  the  decree  of  man 
ufacturing  control  with  which  the  part  was  fabricated  and  tested  prior 
to  its  shipment  to  the  user.  Many  parts  are  cowered  by  specifications 
which  have  several  quality  levels. 

«n  is  the  symbol  for  a  number  of  additional  adjustment  factors  which  ac¬ 
count  for  cyclic  effects,  construction  class,  and  other  factors  that 
modify  failure  rate. 

The  data  used  as  the  basis  to  develop  MIL-HDBK-217B  consist  of  controlled 
test  data,  field  data,  and  expert  opinion.  The  controlled  test  data 
directly  relates  stress/strcngth  variables  on  wide  variety  of  parts  and 
is  suitable  to  establish  the  base  failure  rates  (A^). 

Base  fai'ire  rates,  in  general,  have  been  established  from  tests 
conducted  under  accelerated  stress  conditions  which  speed  up  the  aging 
process.  Stress  levels  were  defined,  time-to-fai lure  data  was  recorded, 
and  all  failure  modes  were  identified.  Part  allure  rates  derived  under 
accelerated  stress  conditions  were  then  concerted  to  normal  operating 
conditions  through  knowledge  of  the  test  acceleration  factors.  Acceler¬ 
ation  factors  were  determined  through  detailed  analyses  of  accelerated 
test  failures  involving  physics-of-failure  studies  to  determine  mechanisms 
of  failure. 

The  aging  pro-ess  has  been  characterized  via  rata  process  models, 
attributed >  Arrhenius  and  Eyring.  that  are  a  recult  of  both  empirical 
data  and  theoretical  considerations.  These  rate  process  models  form  the 
basis  of  physics-of-failure  and  accelerated  test  techniques  and  provide  a 
relationship  between  stress  (electrical  and  thermal),  time,  and  failure 
rate.  The  Arrhenius  model  takes  the  following  general  form: 

s  ■  v  'C,/T 

*  a  constant 

c,  *  a  constant  depending  on  the  activation  energy  of  the  individual 
part  type  failure  mechanism 
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T  =  absolute  temperature  in  °K. 

The  Eyring  model  includes  an  additional  temperature  factor  (T): 


S  =  K2Te 


-c2/T 


Neither  of  these  relationships  have  been  proven  to  be  exact  models 
of  the  time-stress  combination  with  respect  to  failure  rates.  They  are 
merely  approximations,  useful  in  conjunction  with  a  certain  set  of  condi¬ 
tions. 

Although  laboratory  controlled  test  data  provide  valuable  information 
as  to  the  upper  limit  or  potential  reliability  of  parts,  application 
factors  and  the  use  environment  prevent  realization  of  this  potential. 
Field  data  collection  and  injlysis  efforts  have  indicated  part  failure 
rates  well  above  those  determined  from  laboratory  testing.  To  account 
for  the  adverse  influence  of  the  application  environment  and  to  align  the 
base  ♦'allure  rate  (A^)  with  field  experience,  a  series  of  n  factors,  as 
previously  defined,  have  been  developed  to  account  for  specific  produc¬ 
tion,  operation  and  maintenance,  and  application  environment  stress 
factors. 


A.  3  RELIABILITY  PREDICTION  TECHNIQUES. 

A  prediction  of  reliability  is  obtained  by  determi:.ing  the  reliabil¬ 
ity  of  the  lowest  system  level  Item  and  proceeding  through  Intermediate 
levels  until  an  estimate  of  system  reliability  Is  obtained.  The  predic¬ 
tion  methodology  is  dependent  on  the  availability  of:  (1)  accurate  eval¬ 
uation  models  that  reflect  the  reliability  connectivity  of  the  lower 
level  Items  and  (2)  substantial  failure  data  that  has  been  analyzed  and 
reduced  to  a  form  suitable  for  application  to  the  low  level  Items. 

There  are  various  formal  prediction  procedures,  based  on  theoretical 
and  statist4eal  concepts  that  differ  In  the  level  of  data  on  which  the 
prediction  is  based.  The  specific  steps  for  Implementing  these  procedures 
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are  described  in  detail  in  reliability  handbooks.  Among  the  procedures 
available  are  parts  count  methods  and  stress  analysis  techniques. 

The  parts  count  method  provides  an  estimate  of  reliability  based  on 
a  count  by  part  type  (e.g. ,  resistor,  capacitor,  integrated  circuit, 
transistor,  etc.).  This  method  is  applicable  during  early  design  studies 
where  the  degree  of  design  detail  is  limited.  It  involves  counting  the 
number  of  parts  of  each  type,  multiplying  this  number  by  a  generic  fail¬ 
ure  rate  for  each  part  type,  and  summing  up  the  products  to  obtain  the 
failure  rate  of  each  functional  circuit,  subassembly,  assembly  and/or 
block  depicted  in  the  system  block  diagram.  The  advantage  of  this  method 
is  that  it  allows  rapid  estimates  of  reliability  in  order  to  quickly 
determine  the  feasibility  (from  the  reliability  standpoint)  of  a  given 
design  approach.  The  technique  uses  information  derived  from  available 
engineering  information  and  does  not  require  detailed  part-by-part  stress 
and  design  data. 

The  stress  analysis  technique  involves  the  same  basic  steps  as  the 
parts  count  technique.  However,  the  stress  analysis  technique  requires 
the  use  of  detailed  part  models  plus  calculation  of  circuit  stress  values 
for  each  part  prior  to  determining  its  failure  rate.  Each  part  is  eval¬ 
uated  in  its  electrical  circuit  and  mechanical  assembly  application  based 
on  an  electrical  and  thermal  stress  analysis.  Once  part  failure  rates 
are  established,  a  combined  failure  rate  for  each  functional  block  in  the 
reliability  diagram  can  be  determined.  To  facilitate  calculation  of  part 
failure  rates,  worksheets  based  on  part  failure  rate  models  are  normally 
prepared  to  aid  in  the  evaluation.  These  worksheets  are  prepared  for 
each  functional  circuit  in  the  system.  When  completed,  these  sheets 
provide  a  tabulation  of  circuit  part  data  including:  part  description, 
electrical  stress  factors,  thermal  stress  factors,  basic  failure  rates, 
the  various  multiplying  or  additive  environmental  and  quality  adjustment 
factors,  and  the  final  combined  part  failure  rates.  The  variation  in 
part  stress  factors  (both  electrical  and  environmental)  resulting  from 
changes  in  circuitry  and  packaging  is  the  means  by  which  reliability  is 
controlled  during  design. 
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Both  the  parts  count  and  the  stress  analysis  methods  of  predicting 
reliability  rely  on  part  failure  rate  data  obtained  from  MIL-HDBK-217B. 
However,  not  all  parts  used  in  electronic  system  design  are  included  in 
MIL-H0BK-217B.  For  those  parts  not  covered  by  21 78  or  where  little 
supporting  data  is  available,  care  must  be  exercised  in  estimating  their 
failure  rates.  In  general,  estimating  failure  rates  for  parts  having 
limited  failure  data  involves  comparative  evaluations  or  special  tests 
and  studies. 

A.  4  SUMMARY. 

The  part  modeling  methodology  and  reliability  prediction  techniques 
descrioed  in  this  annex  have  been  widely  accepted  and  are  applicable 
during  the  early  design  phase  of  electronic  equipment.  Unfortunately, 
similar  methodologies  for  nonelectronic  components  and  equipment  are  not 
as  well  defined,  although  some  efforts  have  been  undertaken  by  the  Rome 
Air  Development  Center  and  the  Redstone  Arsenal.  Familiarity  with  early 
reliability  prediction  techniques  will  permit  the  operational  test  analyst 
to  use  development  contractor  data,  if  desired,  with  some  acceptable 
level  of  confidence. 
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ANNEX  8 

MISSILE  SYSTEM  DORMANT  RELIABILITY  DEGRADATION 
B.  1  INTRODUCTION'. 


The  need  for  addressing  dormant  reliability  and  the  effects  of  dor¬ 
mancy  was  discussed  in  section  II.  This  annex  will  provide  a  brief  sum¬ 
mary  of  some  of  the  principal  problem  areas  associated  with  dormant  reli¬ 
ability  degradation.  The  causes  of  typical  missile  system  failures  are 
treated  generally  in  rather  broad  categories  relating  to  design,  manufac¬ 
turing,  and  transportation  and  handling.  Examples  of  specific  represen¬ 
tative  failure  modes  are  discussed  for  hydraulic,  electronic,  electrome¬ 
chanical,  and  solid  propellant  components. 

B.2  OESIGN  DEFICIENCIES. 


The  trend  in  missile  systems,  as  discussed  in  section  II,  is  toward 
greater  sophistication,  complexity,  and  periods  of  dormancy.  Therefore, 
the  first  step  toward  achieving  high  dormant  reliability  is  initially 
designing  the  missile  system  to  withstand  long  periods  of  dormancy. 


Careful  selection  of  components  and  materials  is  an  essential  ele¬ 
ment  in  any  attempt  to  minimize  design  deficiencies.  The  coupling  of 
dissimilar  metals  should  be  avoided  wherever  corrosion  is  anticipated  as 
a  result  of  such  coupling.  For  example,  the  so  called  "p'f/ple  plague" 
which  appears  In  electronic  equipment  when  aluminum  wire  is  bonded  to 
gold-plated  posts  should  be  considered  a  design  deficiency  vith  respect 
to  dormancy. 

Designs  which  permit  continuous  physical  stress  on  components  can 
result  in  cracking  which  may,  in  turn,  be  susceptible  to  breakage  or  the 
formation  of  corrosion.  Rubbing  surfaces  will  also  provide  an  area  where 
corrosion  can  begin.  Careful  attention  in  the  system  design  pan  minimize 
or  eliminate  the  corrosion  potential  caused  by  activating  n  system  and 
then  returning  It  to  storage. 
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The  coating  of  electronic  components  and/or  complete  systems  is 
important.  The  ingress  of  contaminants  into  components  or  systems  is  a 
major  cause  of  storage  failures.  These  contaminants  may  cause  oxidation, 
corrosion,  or  a  stray  conduction  path  for  current  in  electrical  compo¬ 
nents.  In  some  cases,  outgassing  of  materials  used  in  coating/encapsul¬ 
ating  may  cause  problems.  Also,  the  flaking  of  metallic  and  non-metal 
finishes  may  result  in  contamination  of  fluids. 

B.3  MANUFACTURING  DEFECTS. 

A  primary  cause  of  reliability  degradation  due  to  manufacturing 
seems  to  be  insufficient  cleaning  of  contaminants  (water,  dirt,  solder, 
cleaning  solutions,  etc.)  from  components.  Also,  the  improper  assembly 
of  electronic  components  (e.g. ,  too  much  or  too  little  pressure  in  making 
terminal  connections)  can  cause  breakage  or  intermittent  opens.  Inade¬ 
quate  solder  connections  which  provide  excess  solder  *nd  solder  fluxes 
can  result  in  stray  conductive  paths.  Most  previous  studies  on  dormant 
reliability  have  found  that  a  substantial  proportion  of  the  failures  were 
caused  by  poor  quality  control  of  the  manufacturing  and  assembly  pro¬ 
cesses.  Failures  were  analyzed  after  periods  of  storage  or  accelerated 
testing  to  determine  their  causes.  Quite  often  the  failure  was  attrib¬ 
uted  to  the  continued  effect  of  a  manufacturing  error  acting  over  time. 
Some  authors  have  indicated  that  failures  of  this  type  may  be  caused  by 
aging.  However  the  -failure  may  be  categorized,  it  is  apparent  that 
proper  manufacturing  and  assembly  can  minimize  the  severity  of  system 
failures  during  dormant  storage. 

B.4  TRANSPORTATION  ANO  HANOLING  INADEQUACIES. 

Transportation  and  handling  of  missile  systems  has  been  a  major 
cause  of  damage  and  subsequent  system  failure.  Several  Instances  of 
mishandling  have  been  recorded  reflecting  serious  damage  inflicted  as  a 
result  of  missiles  being  dropped  from  fork  lifts.  On  the  positive  side, 
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the  Sergeant  missile  was  road  tested  over  more  than  1,100  miles  of  various 
road  conditions  (e.g. ,  improved,  unimproved,  and  asphalt).  Two  missiles 
were  used  in  the  test  and  survived  with  no  problems  ^countered,  indicat¬ 
ing  that  handling  problems  can  be  overcome.  Of  course,  container  design 
is  an  inherent  factor  affecting  the  degree  to  which  missile  systems  can 
withstand  frequent  transportation  and  handling. 

B.5  EXAMPLES  OF  DORMANT  FAILURE  CHARACTERISTICS.  . 

There  are  several  causes  of  system,  subsystem,  and  component  reli¬ 
ability  degradation  while  in  a  dormant  state.  Quite  often,  the  dormant 
failure  inodes  are  the  same  as  those  found  in  the  operating  environment 
although  the  failure  rate  may  be  different.  The  following  discussion  is 
intended  to  provide  insight  into  some  of  the  more  prevalent  component 
failure  modes  for  hydraulic  items,  electronic  devices,  electromechanical 
systems,  and  solid  propellants. 

B.5. 1  Hydraulic  Systems. 

There  is  evidence  to  indicate  that  hydraulic  fluid  can  withstand 
long  storage  periods  without  degradation  provided  it  is  free  of  con¬ 
taminants.  Fluid  from  a  8-24D  aircraft  was  examined  after  17  years  in 
the  Libyan  desert  and  found  to  meet  the  original  specifications.  If  the 
hydraulic  system  is  not  exercised  during  storage  and,  therefore,  is  not 
generating  contaminants  (particles  liberated  because  of  moving  parts), 
then  the  fluid  should  withstand  the  anticipated  dormant  period. 

Hydraulic  seals  may  experience  problems  due  to  breakaway  friction, 
the  friction  encountered  when  a  rod  or  part  moves  through  a  seal.  This 
friction  can  increase  over  time,  and  If  the  Increase  Is  large  relative  to 
the  working  pressure  of  the  system,  then  a  design  deficiency  may  exist. 
In  contrast,  equipment  Items  such  as  servovalves,  actuators,  pumps,  and 
accumulators  can  probably  be  stored  for  periods  of  at  least  five  years 
with  little  chance  of  serious  degradation  as  long  as  the  hydraulic  fluid 
Is  clean. 
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It  is  apparent  that  preparation  is  the  most  important  consideration 
in  storing  hydraulic  systems.  The  fluid  used  must  be  clean,  and  care 
must  be  taken  when  filling  and  assembling  the  system  to  ensure  that  no 
contaminants  are  introduced.  Fittings  must  be  tight,  and  the  exterior 
must  not  provide  for  any  chance  of  corrosion  through  cracks,  scratches, 
or  stress.  Problems  may  occur  in  storing  hydraulic  systems  if  they  are 
to  be  exercised  during  storage  and  returned  to  the  dormant  condition. 
Usage  generates  contaminants  in  the  system  by  generating  particles  which 
can  agglomerate  and  cause  degradation  and/or  failures.  If  operation 
during  storage  is  required  of  the  system,  then  specific  engineering 
designs  must  take  operation  into  consideration.  Perhaps  the  system 
should  be  purged  and  refilled  with  new  fluid. 

B.5.2  Electronic  Systems. 

Several  previous  studies  have  concluded  that  the  failure  modes  found 
in  the  operational  environment  are  essentially  the  same  as  those  result- 
ting  from  dormancy  for  electronic  systems.  Furthermore,  most  failures 
result  from  the  manufacturing  process.  A  Martin  Marietta  study  (refer¬ 
ence  29)  provided  the  following  breakout  of  electronic  part  non-operating 
failure  modes: 


Bonding/Welding  21. 5% 

Photoetching  17.2 

Transportation  and  handling  12.9 

Seal  aging  12.9 

Expansion  coefficient  12.9 

Conductive  cement  8.6 

Cefectlve  hermetic  seals  4.3 

Plating  4.3 

Soldering  4.3 


These  modes  are  directly  associated  with  manufacturing  processes  and/or 
improper  design. 
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Electronic  part  failure  modes  are  dependent  upon  the  environment  and 
the  storage  condition  of  the  component.  Failure  modes  for  semiconductors 
are  the  same  in  storage  as  in  operation.  In  some  components  the  failure 
occurrence  is  independent  of  the  application  environment.  For  others  it 
may  be  time-related  and  environment-dependent.  If  the  failure  is  inde¬ 
pendent  of  the  application  environment,  then  failures  have  the  same  rate 
of  occurrence  in  operation  as  in  storage.  If  the  failure  occurrence  is 
dependent  upon  the  application  environment,  then  the  predominant  failure 
modes  are  bond  or  metallization  defects  which  progress  to  failure  due  to 
temperature  or  mechanical  stress.  If  the  failure  occurrence  is  time  and 
environment  related,  then  the  failure  modes  are  more  likely  to  appear  as 
metal  migration,  intermetal lie  compound  formations,  corrosion,  etc. 

Electronic  part  failure  modes  also  tend  to  be  part  dependent.  Tran¬ 
sistors  have  failures  that  are  generally  categorized  by  opens,  shorts,  or 
parameter  changes.  Resistors  experience  opens,  corrosion,  cracks,  and 
film  flaking.  Current  leakage  is  the  major  problem  in  diodes  and  may  be 
caused  by  any  of  several  factors.  Defective  seals  or  cases  are  the  pri¬ 
mary  fcclts  in  capacitors.  The  usual  failure  modes  within  microelectron¬ 
ics  are  opens,  shorts,  and  current  leakage. 

B.5.3  Electromechanical  Systems. 

Electromechanical  systems  generally  consist  of  gyros,  accelerome¬ 
ters,  switches,  relays,  motors,  generators,  and  starters.  These  devices 
use  electrical  forces  to  accomplish  mechanical  functions.  They  are  used 
in  missile  systems  to  accomplish  functions  such  as  guidance,  ignition, 
safe  and  arming,  and  valve  actuation.  Gyros  experience  a  variety  of 
problems  including  spin  bearing  lubricant  dry  out,  magnetic  variation, 
and  bearing  adhesion.  Most  failures  In  accelerometers  occur  through 
contamination,  and  they  do  not  appear  to  be  significantly  different  than 
operating  failures.  Switch  failures  definitely  appear  to  be  age  related 
and  include  corrosion  of  contacts  and  other  metal  surfaces,  spring  relax¬ 
ation,  and  0-ring  aging. 
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Dormant  failure  data  for  relays  was  extremely  limited.  However, 
operating  failures  are  attributed  primarily  to  contact  welding  due  both 
to  the  contact  material  and  tha  current  passing  through  them.  It  has 
been  recommended  that  relays  be  operated  occasionally  in  storage  at 
no-load  conditions.  Dormant  failure  mode  data  is  also  not  well  documen¬ 
ted  for  motors,  generators,  and  starters.  The  usual  failure  mode  found 
is  outgassing  of  the  lubricant  or  coil  impregnant  which  causes  corrosion 
in  the  brushes,  armature,  etc.  It  is  assumed  that  the  predominant  fail¬ 
ure  mechanisms  are  the  same  as  those  in  gyros  and  switches. 

8.5.4  Solid  Propellants. 

As  a  class,  solid  propellants  can  be  stored  for  extended  periods. 
Four  BOMARC  missile  motors  which  were  between  120-  and  123-months-old 
were  alT  successfully  fired.  Inspection  before  firing  indicated  some 
slight  separation  of  liners  from  cases,  but  this  problem  did  not  affect 
the  firing.  In  general,  the  failure  modes  for  solid  propellants  include 
propellant  cracking,  propellant  separation  from  the  case,  and  chemical 
decomposition.  These  failure  modes  do  not  usually  result  in  complete 
failure.  The  failure  modes  are  caused  by  low  temperatures,  elasticity 
loss  and  expansion  of  propellant  at  high  temperature,  contamination,  slow 
chemical  decomposition,  and  rough  handling.  There  appears  to  be  some 
increase  in  failures  in  single  thrust,  double  base  propellant  and  dual 
thrust,  composite  propellants  with  age.  For  dual  thrust,  double  base 
propellants,  there  does  not  appear  to  be  an  aging  trend.  The  aging  trend 
can  be  slowed  by  using  an  appropriate  stabilizer  that  will  reduce  the 
rate  of  chemical  decomposition  of  the  propellant.  Design  deficiencies 
are  a  more  serious  problem  of  dormant  reliability  degradation  than  the 
materials  themselves. 

B.6  SUMMARY. 

The  principal  contributors  to  low  dormant  reliability  tend  to  be 
missile  system  design  deficiencies  and  manufacturing  process  defects. 
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However,  proper  quality  control  of  the  manufacturing  process  can  reduce 
many  of  the  failures  which  occur  under  dormant  conditions.  Careful 
design  practices  can  minimize  failures  through  proper  selection  of  mate¬ 
rials  and  parts.  Better  missile  system  design  can  also  be  achieved  by 
thoroughly  understanding  the  operations  and  maintenance  concept  and  the 
environment  in  which  the  system  is  to  be  employed.  Proper  handling  and 
measures  to  pro toot  the  system  from  particulate  contamination  and  extreme 
environmental  conditions  will  also  contribute  to  improved  dormant 
reliability. 
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ANNEX  C 

AN  EXAMPLE  OF  THE  LIFE  CYCLE  MODELING  METHODOLOGY 
C.  1  INTRODUCTION. 

The  methodology  presented  in  section  VIII  cannot  be  considered  new 
or  unique.  Variants  of  the  process  have  been  presented  in  several  refer¬ 
ences  and,  while  minor  differences  may  have  existed  between  various 
authors'  presentations,  the  underlying  philosophical  approach  has  always 
been  the  same.  The  approach  presented  in  reference  46  is  considered 
particularly  interesting  because  it  reflects  the  use  of  many  of  the 
concepts  and  techniques  which  have  been  discussed  in  this  study.  It 
utilizes  part  failure  rate  data  and  reliability  prediction  techniques  for 
both  electronics  and  nonelectronic  components  in  a  hypothetical  missile 
system,  accounts  for  various  application  environments,  and  estimates 
missile  flight  reliability  for  alternative  maintenance  concepts.  The 
reference  46  discussion  is  provided  in  this  annex  as  an  example  of  the 
utility  of  the  life  cycle  modeling  approach. 

C.2  LIFE  CYCLE  MODEL. 

The  basic  modeling  techniques  required  for  the  prediction  of  system 
reliability  in  the  dormant  mode  were  established  and  validated  in  1967 
and  updated  in  1973.  These  basic  techniques  were  primarily  for  elec¬ 
tronic  systems  or  the  electronic  portion  of  a  system  with  a  heterogeneous 
part  mixture.  This  was  due  to  a  general  lack  of  well-doci;mented  dormant 
failure  rate  data  on  nonelectronic  components.  With  the  addition  of  the 
nonelectronic  dormant  failure  rates  generated  during  this  study,  life 
cycle  models  can  be  applied  to  entire  systems  wit|>  much  more  accuracy. 

The  life  cycle  model  evaluates  system  reliability  in  terms  of  system 
design  characteristics  and  useful  deployment  schemes,  which  include  the 
effects  of: 
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a)  Service  life  environmental  (deployment)  modes 

b)  Expected  time  in  each  mode 

c)  Failure  detection  capability  of  the  system 

d)  Accumulation  of  failures  from  the  operating  and  dormant 
environments 

d)  Frequency  of  periodic  test  and  checkout. 

A  simplified  life  cycle  model  is  shown  in  figure  C-l  for  a  theo¬ 
retical  missile  system  which  is  periodically  (nonitored  for  failures  after 
deployment.  From  the  figure,  note  that  the  predicted  reliability  of  the 
missile,  after  being  in  a  dormant  environment,  is  a  function  of: 

a)  The  undetected  failures  accumulated  from  prior  modes 

b)  The  dormancy  failure  rate  and  time  in  dormancy 

c)  The  effectiveness  or  testability  factor,  a^,  of  the  sys¬ 
tem. 

An  example  relating  to  this  model  will  be  given  in  the  following 
paragraphs. 

C.3  DORMANCY  MODELS. 

As  evidenced  by  figure  C-l,  the  life  cycle  profile  of  a  system 
encompasses  several  phases  such  as  factory  test,  deployment,  and  final 
end  use.  Therefore,  within  the  overall  life  cycle  model,  individual 
submodels  can  be  developed  to  depict  the  system  reliability  during  these 
different  phases.  For  many  military  systems  the  deployment  mode  initi¬ 
ates  a  long  period  of  dormancy  before  the  system  is  used  in  its  intended 
mission.  Two  basic  types  of  deployment  techniques  exist  for  dormant 
systems:  the  "no  test"  concept  and  the  "periodic  test"  concept.  Dr-^ancy 
models  have  been  developed  for  each  of  these  deployment  techniq*.  js  to 
provide  accurate  estimates  of  system  reliability  at  any  time  during  the 
dormant  period. 

The  "no  test"  model,  used  in  conjunction  with  the  most  basic  deploy¬ 
ment  survival  technique,  predicts  the  reliability  of  systems  designed  to 
the  "wooden  round"  concept.  Under  this  concept,  the  system  deployed  may 


C-2 


UNDETECTED  FAILURE  FLOW 


THE  BDM  CORPORATION 

be  in  a  dormant  state  for  as  long  as  10  years;  it  is  never  tested,  or  is 
tested  just  before  being  used  in  its  intended  mission.  For  some  of  the 
less  complex  systems,  the  utility,  applicability,  and  simplicity  of  this 
technique  provides  a  most  effective  deployment  concept.  However,  as 
system  complexity  increases,  other  means  must  be  found  to  assure  that  an 
acceptable  level  of  reliability  is  maintained  throughout  deployment. 

The  second  deployment  survival  technique  is  used  for  higher  com¬ 
plexity  systems  which  can  experience  considerable  degradation  over  long 
periods  of  dormancy.  In  this  technique,  which  is  the  periodic  test 
concept,  the  deployed  system  is  tested  at  periodic  intervals,  such  as 
every  six  months,  and  any  necessary  repairs  are  made  after  each  test. 

A  third  deployment  technique,  the  constant  monitor  concept,  has  been 
used  occasionally  but  will  not  be  considered  in  this  analysis.  With  this 
technique  the  system  is  constantly  operating  at  very  low  level  power  such 
that  failures  are  detected  immediately. 

To  visualize  the  differences  between  the  two  basic  deployment  sur¬ 
vival  techniques,  examples  are  provided  which  compare  the  effects  and 
results  of  each  method  through  respective  life  cycle  mathematical  models. 
A  hypothetical  tactical  missile  will  be  evaluated  during  its  deployment 
period.  The  missile. is  constructed  of  high  reliability  electronic  com¬ 
ponents  and  standard  grade  nonelectronic  items.  Also,  the  missile  is  to 
be  contained  in  a  controlled  dormant  environment  during  deoloyment. 
Operating  and  dormant  failure  rates  for  the  individual  parts/components 
were  derived  from  field  measurement  data  and  part  failure  modeling  tech¬ 
niques.  Table  C-l  contains  the  combined  electronic  and  nonelectronic 
component  failure  rates  in  the  ground  operating  and  dormant  configure 
tions. 

Table  C-l. 

Electronic  and  Nonelectronic  Failure  Rates 
For  Hypothetical  Missile 


Dormant 

Operating 

Failure  Rate 

Failure  Rate 

Part  Category 

(failures/10*  part-hours) 

(failures/10*  part-hours) 

Electronic 

14.&76  — ” 

1186.967 

Nonelectronic 

14.359 

880.553 

Totals 


29.235 


2067.520 
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In  referring  to  figure  C-l,  mode  4  of  the  life  cycle  model  (deploy¬ 
ment)  is  the  only  variation  to  be  considered  in  the  following  examples. 
Therefore,  the  undetected  failures  through  mode  3  can  be  calculated  to 
determine  the  missile  reliability,  R^,  at  the  end  of  mode  3  or  at  the 
beginning  of  deployment: 

F3  =  (1  -  0l)  XEt£^  (1  -  o3)  (XDtQ^  ♦  XE  t^> 

where: 

F3  =  Expected  failures  through  mode  3 

o1  =  0.95  =  Test  efficiency  of  factory  test 

XE  =  2067.520  failures/10*  part-hours  3  System  operating 
failure  rate 

tc  ~  340  hours  =  Total  operating  time  prior  to  shipment 
fcl 

«3  =  0.90  3  Test  efficiency  of  predeployment  checkout  test 

Xq  =  29.235  failures/'.Q*  part  hours  3  System  dormancy  failure 
u  rate 

tc  *  5  hours  *  Total  operating  time  during  predeployment  checkout 
fc3 

The  expected  failures  prior  to  deployment  can  now  be  estimated: 

♦pa 

F3  »  0.0383 

System  reliability  just  prior  to  deployment  can  now  be  calculated 
and  is: 

R3  *  e  J  *  0.962. 
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C.3.1  No  Test  Concept 

If  the  "no  test"  concept  is  chosen  for  the  missile,  then  the  system 
will  remain  in  a  dormant,  unenergized  state  throughout  the  deployment 
phase  of  its  life  cycle. 

No  system  failures  will  be  detected  during  this  period,  and  the 
total  undetected  failures  which  occur  during  mode  4  (deployment)  of  the 
system  life  cycle  are  found  as  follows: 

fn4  =Vo4 

where 

Fu  =  Expected  failures  during  mode  4  under  "no  test"  concept 
N4 

J-g  *  29.235  failures/10®  part-hours  *  Dormant  failure  rate 
-  1  to  5  years  *  Expected  deployment  time 

The  model  may  be  solved  for  the  total  expected  failures  for  various 
durations,  and,  by  utilizing  the  exponential  equation,  system  reliability 
can  be  calculated. 

Figure  C-2  shows  the  system  reliability  degradation  during  the 
deployment  mode  under  the  "no  test"  concept.  Note  that  the  initial  reli¬ 
ability  is  not  1.0,  but  0.962,  as  calculated  above,  which  is  a  result  of 
the  undetected  failures  through  mode  3.  Therefore,  at  the  end  of  5  years 
the  system  reliability  would  be  approximately  0.26  which  Is  not  accept¬ 
able  for  most  tactical  missiles. 

C.3.2  Periodic  Test  Concept. 

In  order  to  maintain  a  higher  reliability  throughout  deployment,  a 
periodic  test  strategy  may  be  chosen.  Usually,  trade  studies  are 
Involved  in  selecting  the  optimum  checkout  Interval.  However,  it  shall 
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be  assumed  that  the  trade  studies  have  already  been  performed,  and  a 
period  test  interval  of  one  year  selected. 

An  important  consideration  with  the  periodic  test  concept  is  the 
effects  of  power  on/off  cycling  on  the  system  reliability.  If  the  system 
does  not  have  adequate  transient  suppression  circuitry,  the  power  cycling 
may  have  a  disastrous  effect  upon  system  reliability  and  availability. 

It  shall  be  assumed  that  the  system  under  consideration  does  have  pro¬ 
tection  against  transients.  However,  the  power  cycling  will  still  cause 
some  degradation  to  the  system.  This  degradation  will  be  assumed  to 
occur  only  on  the  electronic  portion  of  the  system.  Data  from  reference 
18  will  be  used  to  quantify  the  effects  of  on-off  cycling  on  the  system 
reliability. 

For  calculating  the  esimated  number  of  failures  that  occur  between 
periodic  tests,  certain  values  relating  to  the  test  must  be  established. 
The  interval  between  periodic  tests  will  be  one  year.  The  total  operat¬ 
ing  time  during  periodic  test  is  assumed  to  be  three  hours,  which  also  is 
sufficient  time  for  the  internal  temperature  rise  to  stabilize  at  the 
maximum  operating  value.  The  model  for  calculating  the  estimated  fail¬ 
ures  is  as  follows: 

Fp  =  [(NCKC/0)  *0E+  r0A0  *  rEXE J  t04 

where 

Fp  -  Expected  failures  during  one  periodic  test  interval 

N-  *  0.00023  *  Ratio  of  total  power  cycles  to  total  periodic  test 
interval  time  (cycles  per  hour) 

*  270  *  Ratio  of  cyclic  failure  rate  to  dormancy  failure  rate 

'  (estimated  for  an  average  mix  of  high  reliability 

parts) 

*  14.876  failures/10*  part-hours  *  Dormant  failure  rate  of 

electronic  parts 

r-  *  0.99966  *  Ratio  of  total  dormant  time  to  total  periodic  test 
Interval  time 
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Xjj  =  29.235  failures/106  part-hours  =  System  dormant  failure  rate 

\c  =  2067  .'520  failures/106  part-hours  =  System  energized  failure 

rate 


r^  =  0.00034  =  Ratio  of  total  operating  time  to  total  periodic 
test  interval  time 


=  8,760  hours  =  Total  periodic  test  interval  time. 


The  failure  rate  values  are  taken  from  table  C-l.  The  ratios,  r^ 
and  r^,  are  based  upon  the  assumption  of  a  1-year  periodic  test  interval 
(8,760  hours)  with  a  3-hour  operating  time  during  test.  A  total  of  two 
power  on-off  cycles  are  assumed  per  test  interval,  from  which  Nc  is 
obtained.  The  value  of  is  assumed  to  have  been,  for  this  system, 

based  upon  such  factors  as  high  reliability  parts,  part  mix,  cyclic  rate 
and  duration,  transient  suppression  capabilities,  and  energy  level  at¬ 
tained  during  cycling.  Substituting  these  values  into  the  model: 

Fp  =  [(0.00023)(270)(14.876  x  10“«)  ♦  (0.99966)(29.235  x  10-6) 

+  (0.00034X2067.520  x  10"6)]  8760 

Fp  =  0.2703  failures 


By  combining  the  value  calculated  for  Fp  with  that  previously 
obtained  for  F^  and  applying  the  sum  to  the  exponential  equation,  the 
system  reliability  just  priur  to  the  first  periodic  test  is  obtained: 


-(Fd  ♦  F,)  -(0.3086) 

S  =  e  p  =  e 


=  0.734 


Thus,  by  using  the  exponential  equation,  system  reliability  can  be 
calculated  at  the  time  of  test.  Immediately  after  the  periodic  test,  the 
reliability  will  be  higher  since  detected  failures  will  have  been 
repaired.  However,  the  reliability  will  not  regain  Its  former  level  at 
the  previous  periodic  test  because  there  are  undetected  failures  remain¬ 
ing  in  the  system. 
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For  comparative  purposes  it  shall  be  assumed  that  the  value  of  a^, 
the  efficiency  of  the  test  in  detecting  failures,  is  90  percent.  The 
system  reliability  following  first  periodic  test  can  be  calculated  in  the 
following  manner: 


-Id  *  O  (Fp)  ♦  F  ] 

R  =  e  4  P  3 

-[.10(0.2703)  +  0.0383] 

R  =  e 

-0.0653 

R  =  e  9  0.937 

Figure  C-3  shows  the  resulting  reliability  degradation  over  a  5-year 
deployment  period;  the  "no  test"  degradation  for  the  same  period  of  time 
is  also  designated  by  the  dashed  lines.  Other  than  the  dormant  failure 
rate,  the  most  significant  contributors  to  achieving  long  term  dormancy 
system  reliability  are  the  test  efficiency  and  the  frequency  of  periodic 
test. 

C.4  SUMMARY 

le  life  cycle  model  example  presented  in  this  annex  demonstrates 
the  utility  of  the  methodology  ai-  a  tool  for  projecting  mature  missile 
system  operational  reliability.  As  previously  discussed,  however,  the 
level  of  detail  required  to  adequately  represent  a  specific  missile 
system  is  dependent  upon  that  missile's  operation  and  maintenance  con¬ 
cepts  and  its  intended  application  environment. _ 
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Figure  C-3.  Missile  Reliability  after  5  Years  of  Dormant  Deployment 
Under  "Wooden  Round"  and  Periodic  Test  Concept 
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ANNEX  0 

TIME  TO  FAILURE  DISTRIBUTION  AND  STATISTICAL  TEST  DESIGN 
D.l  INTRODUCTION. 

It  has  been  traditional  to  restrict  the  number  of  probability  func¬ 
tions  used  in  reliability  work.  It  has  been  found  that  a  relatively 
small  number  of  functions  satisfy  most  of  the  needs,  and  the  statistical 
theory  is  not  very  well  developed  for  many  functions.  One  of  the  most 
often  used  functions  is  the  exponential.  This  annex  will  provide  a  brief 
introduction  to  the  exponential  distribution,  some  basic  reasons  for  its 
popular  acceptance,  a  discussion  of  the  notion  of  statistical  test  design, 
and  some  thoughts  on  validating  the  exponential  model. 

D.2  THE  EXPONENTIAL  DISTRIBUTION. 

A  typical  life  characteristic  curve  for  a  component  or  item  can  be 
defined  by  three  failure  components  which  predominate  during  the  three 
periods  of  an  item's  life.  These  components  can  be  described  in  terms  of 
a  hazard  rate  which  can  be  simply  stated  as  the  conditional  probability 
of  failure.  The  failure  components  include: 

a)  Early  Failure— due  to  design  and  quality-rated  manufactur¬ 
ing  flaws  and  which  have  a  decreasing  hazard  rate. 

b)  Stress  Related  Failure— due  to  application  stresses  and 
which  have  a  constant  hazard  rate. 

c)  Wearout  Failures— due  to  aging  and/or  deterioration  and 
which  have  an  increasing  hazard  rate. 

The  hazard  rate  varies  with  the  principal  periods  of  an  item's  life. 

a)  The  infant  mortality  period  is  characterized  by  a  high  but 
rapidly  decreasing  hazard  rate  that  is  composed  of: 

1)  a  high  quality  failure  component 

2)  a  constant  stress  related  failure  component 

3)  a  low  wearout  failure  component. 

b)  The  useful  life  period  is  characterized  by  a  constant 
hazard  rate  that  is  composed  of: 
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1)  a  low  (and  decreasing)  quality  failure  component 

2)  a  constant  stress  related  failure  component 

3)  a  low  (but  increasing)  wearout  failure  component. 

Note:  The  combination  of  all  three  components  results  in  a 
constant  hazard  rate  because  the  decreasing  quality  failures 
and  increasing  wearout  failures  tend  to  offset  each  other,  and 
because  the  stress  related  failures  exhibit  a  relatively  large 
amplitude. 

c)  The  wearout  period  is  characterized  by  an  increasing 

hazard  rate  that  is  composed  of: 

1)  a  negligible  quality  failure  component 

2)  a  constant  stress  related  failure  component 

3)  an  initially  low  but  rapidly  increasing  wearout 
failure  component. 

The  general  approach  to  reliability  for  electronic  systems  is  to 
minimize  early  failures  by  emphasizing  factory  test  and  inspection  and 
preventing  wearout  failures  by  replacing  short  life  parts.  Consequently, 
the  useful  life  period  characterized  by  stress  related  failures  is  the 
most  important  period,  and  the  one  to  which  design  action  is  primarily 
addressed. 

During  the  useful  life  period  the  hazard  rate  is  constant.  A  con¬ 
stant  hazard  (or  failure)  rate  is  described  by  the  exponential  failure 
distribution.  Thus,  the  exponential  failure  model  reflects  the  fact  that 
the  item  must  represent  a  mature  design  Whose  failure  rate,  in  general, 
is  primarily  comprised  of  stress  related  failures.  This  means  that  early 
failures  have  been  minimized,  and  wearout  is  not  noticeable  or  is  beyond 
the  period  of  concern.  The  magnitude  of  this  failure  rate  is  directly 
related  to  the  stress/strength  ratio  of  the  item. 

The  exponential  model  can  be  derived  from  the  basic  notions  of 
probability.  When  a  fixed  number*,  NQ,  of  components  are  repeatedly 
tested,  there  will  be,  after  a  time,  t,  Ng  components  which  survive  the 
test  and  components  which  fail.  The  reliability  or  probability  of 
survival  is  at  any  time  t  during  the  test: 
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N  N 

R(t)  =  —  =  - - - 

Nq  (Ns+Nf) 

Since  Ng  =  Nq  -  N^,  reliability  can  be  written: 
N  -N. 

R(t)  =  r-1  =  1  ■  r  =  1  '  F(t) 

0  0 


45  =  =  -f(t) . 

dt  N  dt  utJi 
o 


where 


f(t).  =  the  failure  density  function,  i.e. ,  the  probability 

that  a  failure  will  occur  in  the  next  time  increment  dt. 


The  hazard  rate  z(t)  is  defined  as  the  ratio  of  the  fractional 
failure  rate  to  the  fractional  surviving  quantity,  that  is,  number  of  the 
original  population  still  operating  at  time  t,  or  simply  the  conditional 
probability  of  failure. 


z(t)  = 


_  f(t)  _  f(t 


1  v  y 

-  / 

ft * 


f(t)dt 


For  the  exponential  distribution, 

-  f(t)  =  X  e_A,t 
z(t)  =  X 

In  general,  it  can  be  assumed  that  the  hazard  rate  of  electronic 
elements  and  systems  remains  constant  over  practical  intervals  of  time, 
and  that  z(t)^  =  X^.  Hence,  X^,  a  constant,  represents  the  expected 
number  of  random  failures  per  unit  of  operating  time  of  the  i^  element, 
i.e.,  the  failure  rate.  Thus,  when  a  constant  failure  rate  can  be 
assumed: 
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f<t). 


-dR(t) . 


.  _  _ '1  .  dt 

z(t)i  ~  xi  •  srur  "  rc t )  • 

Solving  this  differential  equation  for  R(t).  gives  the  exponential 
distribution  function  commonly  used  in  reliability  prediction: 

-M 

R(t).  =  e  1 

Also,  the  mean  time  to  failure  can  be  determined  by: 

a 

R(t)dt, 


MTBF 


-f 


so  that,  when  a  constant  failure  rate  A.  can  be  assumed: 


The  above  expressions  for  R(t).  and  MTBF.  are  the  basic  mathematical 
relationships  used  in  reliability  prediction.  It  must  be  emphasized,, 
however,  that  these  expressions  were  derived  based  on  the  fundamental 
assumption  that  the  failure  rate  of  the  item  under  consideration  is  a 
constant. 


0.3  REASONS  FOR  ACCEPTING  THE  EXPONENTIAL  DISTRIBUTION. 

The  emphasis  on  the  exponential  distribution  in  reliability  work 
makes  it  worthwhile  to  discuss  the  use  of  this  function  as  ?  failure- 
probability  model.  The  mechanism  underlying  the  exponential  reliability 
function  is  that  the  hazard  rate  (or  the  conditional  probability  of 
failure  in  an  interval  given  survival  at  the  beginning  of  the  interval) 
is  independent  of  the  accumulated  life. 
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The  use  of  this  type  of  "failure  law"  for  complex  systems  is  judged 
applicable  because  of  the  many  forces  that  can  act  upon  the  item  and  pro¬ 
duce  failure.  As  stated  previously,  the  stress/strength  relationship  and 
varying  environmental  conditions  result  in  essentially  random  failures. 

Another  factor  for  assuming  the  exponential  distribution  in  long-life 
complex  systems  is  the  so-called  “approach  to  a  stable  state,"  wherein 
the  system  hazard  rate  Is  effectively  constant  regardless  of  the  failure 
pattern  of  individual  parts.  This  state  results  from  the  mixing  of  part 
ages  when  failed  elements  in  the  system  are  replaced  or  repaired.  Over  a 
period  of  time,  the  system  hazard  rate  oscillates,  but  this  cyclic  move¬ 
ment  diminishes  in  time  and  approaches  a  stable  state  with  a  constant 
hazard  rate. 

A  third  argument  for  assuming  the  exponential  distribution  is  that 
the  exponential  can  be  used  as  an  approximation  of  some  other  function 
over  a  particular  interval  of  time  for  which  the  true  hazard  rate  is 
essentially  constant. 

D.4  STATISTICAL  TEST  DESIGN. 

The  objective  of  statistical  testing  is  to  make  a  decision  with  a 
specified  level  of  confidence  concerning  the  risks  to  both  the  user  and 
the  developer  in  rejecting  the  test  parameter. 

The  underlying  theory  in  developing  test  methodologies,  and  in  par¬ 
ticular  dormant  reliability  testing,  is  sound;  however,  rarely  is  a  dor¬ 
mant  reliability  test  structured  during  IOT&E/FOT&E  with  fully  committed 
assets.  In  the  dormant  environment,  high  lifetimes  are  expected,  and  to 
develop  a  test  to  obtain  a  high  confidence  in  the  outcome  would  involve 
long  test  periods  and/or  large  sample  sizes.  Also,  cost  restrictions 
dictate  that  limited  assets  can  be  allocated  for  dormant  testing  pur¬ 
poses. 

In  testing  for  dormant  reliability,  it  is  frequently  necessary  to 
decide  if  a  system  meets  certain  desired  or  specified  goals.  This  is 
where  hypothesis  testing  is  used. 
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D.4.1  Hypothesis  Testing. 

Hypothesis  testing  requires  stating  a  null  hypothesis,  Hq,  concern¬ 
ing  the  mean  time  to  failure  of  the  items  under  test,  where  this  mean 
time  to  failure,  8,  is  the  mean  of  the  exponential  distribution.  An 
alternative  hypothesis,  Hp  which  is  less  than  or  greater  than  Hq,  is 
implied  or  specified  in  these  test  methodologies. 

For  example,  a  null  hypothesis  might  be  that  the  mean  time  to  fail¬ 
ure  is  greater  than  or  equal  to  20,000  hours  (0Q).  The  alternative  hypo¬ 
thesis  might  be  that  the  mean  time  to  failure  is  less  than  5,000  hours 
(8^).  The  20,000  hours  might  be  a  system  specification  value  (desired 
value)  and  the  5,000  hours  would  represent  the  minimum  acceptable  value, 
i.e. ,  the  threshold. 

A  statement  of  the  above  hypothesis  in  general  form  is: 

H  6  >  20,000  hours 

H^:  8  <  5,000  hours 

Two  types  of  errors  present  themselves  during  hypothesis  testing: 

a)  Type  I  -  rejecting  the  null  hypothesis,  Hq,  when  it  is 
true.  The  probat  lity  of  this  type  of  error  is  repr¬ 
esented  by  a,  and  is  called  the  developer's  risk,  or 
level  of  significance. 

b)  Type  II  -  accepting  the  null  hypothesis  when  in  fact  the 
alternative  hypothesis  is  true.  The  probability  of  this 
type  of  error  is  represented  by  p,  and  is  called  the 
user's  risk. 

Tradeoffs  between  a  and  p  can  be  made,  but  the  required  sample  size 
becomes  larger  for  a  higher  degree  of  certainty  of,  making  the  correct 
decision.  The  a  and  p  should  be  specified  before  any  testing  is  don-j. 


0.4.2  Chi-Square  Distribution. 


Kapur  and  lamberson  (1977)  reference  12,  state  that  if  t  is  exponen- 
tially  distributed,  then  the  statistic  is  distributed  as  X2(2r)» 
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t  being  the  total  test  tine  and  r  the  number  of  failures.  The  degrees  of 

freedom  for  this  chi-square  statistic  are  2r. 

A  test  of  the  hypothesis  discussed  above  involves  the  use  of  the 

2t 

above  chi-square  statistic.  H  is  rejected  when  that  statistic,  is 

O  Oq 

too  small.  The  statistic  is  too  small  when  its  value  falls  below  the 
chi-square  critical  value. 

If  H  is  true,  a  lOO(l-a)  percent  confidence  interval  for  8  is  given 

by  r  i 


2t 

7 - 

x(l-cr,2r) 


<  0 


=  1 


0.4.3  Sample  Size  Determination. 


Two  commonly  used  test  methods  which  can  be  employed  in  dormant 
reliability  ‘.esting  are  fixed-length  tests  and  tests  which  are  truncated 
if  Ur  a  predetermined  number  of  failures  have  occurred.  During  testing, 
failed  items  may  or  may  not  be  replaced  after  being  repaired.  Each 
situation  will  be  discussed. 


0.4. 3.1  Flxed-Tiae  test  With  Replacement. 

The  test  situation  requires  that  some  number,  n,  of  the  systems  be 
tested  for  a  specified  period  of  time,  t.  Once  80,  0^,  a,  and  p  are  spe¬ 
cified,  the  acceptable  number  of  failures,  r,  is  determined  by  choosing 
the  smallest  r  for  which 

>  !i 

y  -  0  • 

X(P,2r)  0 

during  testing,  if  the  number  of  failures  observed  is  greater  than 
r,  the  null  hypothesis  (i.e. ,  8  >  20,000  hours)  can  be  rejected  with  a 
100  (1-a)  percent  confidence  that  a  Type  l  error  has  not  been  committed. 
Once  r  is  determined,  the  sample  size  Is  determined  by  the  formula 
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For  example,  let  the  null  and  alternative  hypotheses  be 
H  :  8  >  20,000  hours 
H,:  0  <  5,000  hours 

and  let  a  =  .10  and  9  =  .05.  Then  r  =  5,  and  if  the  test  time  is  t  = 
5,000,  the  required  sample  size  is 

20,000  (4.865) 
n  -  2 -(57TO 

n  =  9.73 

and  n  =  10  is  selected  to  provide  an  integer  value  for  the  sample  size. 

D.4.3.2  Fixed-Time  Test  Without  Replacement. 

The  number  of  acceptable  failures,  r,  is  determined  as  above,  but 
the  sample  size,  n,  is  determined  by 

n  =  [  r/( I  -  e’170)]  , 

where 

c  ’  0ox(l-o, 2r)/2r 
c  *  20,000  (6. S7)/10 
c  *  13,140. 

Then 

n  «  C5/<1-«“5000/13140)) 
n  »  15.79 

and  n  »  16  is  selected. 
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D.4.3.3  Tests  Truncated  After  a  Fixed  Number  of  Failures. 

If  n  items  are  randomly  selected  for  testing,  and  testing  is  termi¬ 
nated  when  the  r-th  failure  occurs,  there  is  no  established  rule  for 
determining  what  the  sample  size,  n,  should  be.  The  number  of  failures, 
r,  is  determined  as  above.  By  looking  at  the  sample  size  formula  in 
paragraph  0.4. 3.1,  it  can  be  seen  that  the  effect  of  increasing  n  is  to 
shorten  the  necessary  test  time.  If  available  test  time  is  limited  and 
the  test  items  are  not  expensive,  a  test  in  which  the  first  r  failures  (r 
«  n)  out  of  n  items  tested  might  be  preferred.  If  test  items  are  expen¬ 
sive  and  there  is  ample  test  time  available,  a  test  based  on  r  failures 
(r  =  n)  out  of  n  items  tested  might  be  preferred. 

Whether  with  or  without  replacement,  the  procedure  for  estimating 
the  mean  life,  0,  in  tests  truncated  at  the  r-th  failure  remains  the 

A 

same.  The  formula  for  computing  the  estimate  of  the  mean  life,  6,  of  the 
sample  changes  slightly  depending  on  whether  the  test  is  with  or  without 
replacement  of  failed  items.  See  reference  30  for  further  information. 


D.4.3.4  Sequential  life  Tests. 


Improvements  on  the  procedures  of  paragraphs  D.4.3.1  -  D.4.3.3  can 
be  made  by.  the  use  of  a  sequential  procedure.  At  any  point  in  time 
during  testing  a  decision  may  be  made  to  accepjt,  reject,  or  continue 
testing.  See  reference  30  fbr  the  details  of  this  procedure. 

0.4.4  Determining  Statistical  Confidence  With  limited  Assets. 

If  the  assets  provided  are  less  than  the  number  determined  necessary 
in  paragraph  D.4.3.1,  either  the  lOO(l-o)  percent  confidence  level  will 
change,  or  the  number  of  acceptable  failures  (Including  the  value  of  p) 
will  change. 

Determination  of  the  100(1-a)  percent  confidence  level  and  p  value 
In  both  cases  will  be  explained  In  the  following  paragraphs. 
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D.4.4.1  Change  In  User  Risk  and  Allowable  Failures  With  Limited  Assets. 

Given:  Systems  Required:  n  =  10 
Systems  Provided:  n  =  5 
a  =  .10 

0Q  =  20,000  hours 
9.|  =  5,000  hours 
t  =  5,000  hours 

9  v2 

„  ,  V  (!-«■  2D 

v2'  -  2nt 

x  (1-a,  2r)  60 


2  _  2  x  5  x  5000 

x  (.90,2r)  20,000 

=  2.5 

Determine  the  r1  value  (new  number  of  acceptable  failures)  associated 
with  a  chi-square  critical  value  of  2.5  and  1-a  =  .30.  A  conservative 
value  of  r'  =  3  is  selected. 

The  user's  risk,  p,  must  increase  to  .20,  since 

x2 

^■-9Q,S^  must  still  >  .25. 

X  (P..6) 

0.4. 4. 2  Change  In  User  and  Developer  Risk  With  Limited  Assets. 

Given:  Systems  Required:  n  =  10 
Systems  Provided:  n  =  5 
Acceptable  Failures:  r  =  5 
6Q  *  20,000  hours 
01  =  5,000  hours 
t  3  5,000  hours 


0-10 
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2 

=  9oX,.0:aJ,2r) 

"  It 

v2  -  2nt 

x  (1-a,  2r)  eQ 


x  (1-a,  10) 


=  2.5 

Determine  the  new  a  level  from  a  chi-square  table  in  the  degrees  of 
freedom  row  labeled  10.  This  gives  1-a  -  .99,  which  implies  the  new  a  = 
.01. 

Once  the  new  a  is  determined,  the  new  0  may  also  be  found  since 


must  still  >  .25 

X  0,10) 

0  must  be  approximately  .42. 

0.4.5  Validating  the  Exponential  Failure  Model. 


The  exponential  failure  model  is  the  most  commonly  used  distribution 
in  life  testing  situations.  However,  frequently  it  is  used  because  it  is 
the  easiest  model  to  apply  and  not  necessarily  the  correct  model  to  use. 

Several  tests  are  available  to  validate  the  hypothesis  that  the  time 
to  failure  data  is  representative  of  an  exponential  distribution.  Kapur 
and  Lamberson  (reference  12)  state  that  one  of  the  most  powerful  tests 
available  to  detect  "either  an  Increasing  or  decreasing  failure  rate  is 
Bartlett's  test."  The  test  statistic  is  given  by: 

rt  r 

2r  ln^)  -  7  In 

L  i=1 

Br  * - TT-(7TTJ75? - 


0-11 
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where  X.  is  a  random  variable  representing  time  to  failure,  r  is  the 

r 

number  of  failures,  and  t  =  X..  . 


"Under  the  hypothesis  of  an  exponential  distribution,  the  statistic 
8r  is  chi-square  distributed  with  r-1  degrees  of  freedom,  and  a  two- 
tailed  chi-square  test  is  in  order."  Reject  the  hypothesis  that  mean 
time  to  failure  follows  an  exponential  distribution  if  Br  does  not  fall 
in  the  interval 

2  2 
X  (1  -  2*  r-1),  X  r-1)  . 

If  the  hypothesis  is  rejected,  then  another  distribution  model  will  have 
to  be  identified  to  represent  time  to  failure. 

Other  candidate  distribution  models  which  have  frequently  been  used 
in  life  testing  include  the  normal,  log  normal,  Weibull,  and  gamma.  The 
Weibull  distribution  is  probably  the  most  widely  used  distribution  for 
life  testing  applications  after  the  exponential  distribution.  Generally, 
determination  of  the  proper  distribution  model  is  a  difficult  task  unless 
considerable  test  data  are  available.  For  example,  distribution  models 
such  as  the  Weibull,  log  normal,  and  gamma  will  generally  fit  well  in  the 
middle  of  the  range  of  the  random  variable  but  differ  in  the  tails  of  the 
distribution.  Such  a  condition  is  not  favorable  since  the  focus  in 
reliability  work  is  on  high  reliability,  and  the  tails  of  the  distribu¬ 
tion  tend  to  be  most  important.  There  are  several  statistical  goodness- 
of-fit  tests  which  can  be  used  in  the  distribution  selection  process,  but 
their  utility  is  often  limited  because  of  the  paucity  of  test  data. 
Experience  with  similar  systems  and  brute  force  graphical  plotting 
techniques  (e.g. ,  histograms,  probability  paper,  etc.)  may  provide  the 
best  means  for  selecting  a  failure  distribution  model. 
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0.5  SUMMARY. 

The  exponential  distribution  is  the  most  commonly  used  distribution 
in  life  testing  applications.  Its  general  applicability  in  complex 
systems  is  based  upon  the  accepted  assumption  that  the  system  time  to 
failure  distribution  will  approach  the  exponential  even  though  the 
individual  components  may  have  different  failure  distributions.  Statis¬ 
tical  hypothesis  testing  based  upon  well-defined  evaluation  criteria 
provides  the  foundation  for  determining  the  appropriate  sample  size  for 
failure  testing.  While  the  exponential  distribution  is  widely  accepted 
and  applicable  across  a  broad  spectrum  of  situations,  its  validity  should 
be  established  against  the  actual  test  data.  If  the  exponential  distri¬ 
bution  cannot  be  accepted,  then  a  search  for  an  acceptable  failure 
distribution  model  must  be  initiated. 
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ANNEX  E 

ELECTRONIC  EQUIPMENT  SCREENING  METHODS 
E.  1  INTRODUCTION. 

Part  screening  was  introduced  in  section  IV  as  a  form  of  accelerated 
testing  applied  during  the  infant  mortality  phase  of  the  equipment's 
life.  Screening  tests  are  generally  used  to  compress  the  early  failure 
period  and  reduce  the  failure  rate  to  an  acceptable  level  as  quickly  as 
possible.  Table  E-l  has  been  extracted  from  the  Reliability  Design 
Handbook  (reference  34)  to  provide  a  convenient  reference  source  of 
potential  screening  methods.  The  use  of  screening  methods  as  part  of 
acceptance  testing  appears  feasible  but  deserves  further  study. 


E-l 


( 
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Table  E-l.  Comparison  of  Screening  Methods 


Screen 

Defects 

Effectiveness 

Cost 

Contents 

Interval  visual 
inspection 

Lead  dress 
Metallization 

Oxide 

Particle 

Die  bond 

Wire  bond 

Contamination 

Corrosion 

Substrate 

Inexpensive 
to  moderate 

This  is  a  mandatory  screen  for  high- 
reliability  devices.  Cost  will  depend 
upon  the  depth  of  the  visual  inspection. 

Infrared 

Design  (thermal) 

Verjr  good 

Expensive 

For  use  in  design  evaluation  only. 

X-Ray 

Die  bond 

Lead  dress  (gold) 
Particle 
Manufacturing 
(gross  errors) 

Seal 

Package 

Contamination 

Excellent 

Good 

Good 

Good 

Good 

Good 

Good 

Moderate 

The  advantage  of  this  screen  is  that 
the  die-to-header  bond  can  be  examined 
and  some  inspection  can  be  performed 
after  encapsulation.  However,  some 
materials  are  transparent  to  X-rays 
(i.e.,  At  and  Si)  and  the  cost  may  be 
as  high  as  six  times  that  of  visual 
inspection,  depending  upon  the  com¬ 
plicity  of  the  test  system. 

High  temperature 
storage 

Electrical  (sta¬ 
bility) 
Metallization 

Bulk  silicon 
Corrosion. 

Good 

Very 

inexpensive 

This  is  a  highly  desirable  screen. 

Temperature 
cycl ing 

Package 

Seal 

01 e  bond 

Hire  bond 

Cracked  substrate 
Thermal  mismatch 

.  Good 

Very 

inexpensive 

This  screen  may  be  one  of  the  most 
effective  for  aluminum  lead  systems. 

Thermal  shock 

Package 

Seal 

Ole  bond 

Wire  bond 

Cracked  substrate 
Thermal  mismatch 

Good 

Inexpensive 

This  screen  is  similar  to  temperature 
cycl ing  but  Induces  higher  stress 
levels.  As  a  screen  it  is  probably  no 
better  than  temperature  cycling. 

Constant 

acceleration 

lead  dress 

Die  bond 

Hire  bond 

Cracked  substrate 

Good 

Moderate 

At  ZO. 000-0  stress  levels,  the  effec¬ 
tiveness  of  this  screen  for  aluminum  is 
questionable. 

Shock 

(unmonitored) 

Lead  dress 

Poor 

Moderate 

The  drop-shock  test  is  considered 
inferior  to  constant  acceleration. 
However,  the  pneupactor  shock  test  may 
be  more  effective.  Shock  tests  may  be 
destructive. 

Shock 

(monitored) 

Particles 
Intermittent  short 
Intermittent  open 

Poor 

Fair 

Fair 

Expensive 

Visual  or  X-ray  inspection  is  preferred 
for  particle  detection. 

Vibration 

fatigue 

Lead  dress 

Package 

Ole  bond 

Hire  bond 

Cracked  substrate* 

Poor 

. 

Expensive 

This  test  may  be  destructive.  Except 
for  work  hardening,  it  is  without 
merit. 

Vibration  vari¬ 
able  frequency 
(unmonitored) 

Package 

Ole  bond 
wire  bond 

Substrate 

Fair 

Expensive  . 

Vibration  vari¬ 
able  frequency 
(monitored) 

Particles 

Lead  dress 
Intermittent  open 

Fair 

Good 

Good 

Very  ■ 
expensive 

The  effectiveness  of  this  screen  for 
detecting  particles  is  part -dependent. 
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Table  E-l.  Comparison  of  Screening  Methods  (Concluded) 


Random  vi brat  ton 
(unmonitored) 


Random  vibration 
(monitored) 


Helium  leak  test 


Radiflo  leak 
test 


Nitrogen  bomb 
test 


Gross-leak  test 


High-voltage 

*est 


Isolation 

resistance 


Intermittent 
operation  life 


Ac  operating 
life 


Oc  operating 
life 


High- temperature 
ac  operating 
Mfe 


Defects 

Effectiveness 

Cost 

Coements 

Package 

Die  bond 

Hire  bond 

Substrate 

Good 

Expensive 

This  Is  a  better  screen  than  VVF 
(unmonitored)  especially  for  space- 
launch  equipment,  but  it  is  more 
expensive. 

Particles 

Lead  dress 
Intermittent  open 

. 

Pair 

Good 

Good 

Very 

expensive 

This  is  one  of  the  most  expensive 
screens;  when  combined  with  only  fair 
effectiveness  for  particle  detection. 

It  is  not  recoemended  except  In  very 
special  situations. 

Package 

Seals 

Good 

Moderate 

This  screen  Is  effective  for 
detecting  leaks  In  the  range  of 

10'*  to  10*10  Attm  cc/sec. 

HM 

Good 

Moderate 

This  screen  is  effective  for  leaks  in 
the  range  of  1C*®  to  10* 12  Attm  cc/sec. 

Good 

Inexpensive 

This  test  Is  effective  for  detecting 
leaks  between  the  gross-and-flne-leak- 
detectlon  ranges. 

Good 

Inexpensive 

Effectiveness  Is  volume -dependent. 
Detects  leaks  greater  than 

10  Attm  cc/sec. 

Oxide 

Good 

Inexpensive 

Effectiveness  Is  fabrication  dependent. 

Lead  dress 

Metallization 

Contamination 

Fair 

Inexpensive 

Metallization 

Bulk  silicon 

Ox<de 

Inversion/ 

channeling 

Design 

Parameter  drift 
Contamination 

Good 

Expensive 

Probably  no  better  than  ac  operating 
life. 

Metallization 

Bulk  silicon 

Oxide 

Inversion/ 

channeling 

Design 

Parameter 

Contamination 

Very  good 

Expensive 

Essentially  the 
same  as  intermit¬ 
tent  life. 

aOOQ 

Expensive 

No  mechanisms  are  activated  that  could 
not  be  better  activated  by  ac  life 
tests. 

Same  as  ac 

operating  life 

Excellent 

Very 

expensive 

Temperature  acts  to  accelerate  failure 
rzchanisms.  This  Is  probably  the  most 
expensive  screen  and  one  of  the  most 
effective. 

High-temperature  Inversion/ 
reverse  bias  channeling 


Poor 


Expensive 
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